fixes

multi cluster
2026-03-19 15:42:41 +01:00 · 2026-03-18 22:28:38 +01:00
211 changed files with 1842 additions and 8849 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +0,0 @@
-# Force LF line endings for shell scripts
-*.sh text eol=lf
--- a/.gitea/workflows/ai-review.yaml
+++ b/.gitea/workflows/ai-review.yaml
@@ -1,47 +0,0 @@
-name: AI Code Review
-
-on:
-  pull_request:
-    types: [ labeled, synchronize ]
-
-jobs:
-  ai-review:
-    if: >-
-      (github.event.action == 'synchronized' && contains(toJSON(github.event.pull_request.labels), 'ai-review')) || contains(toJSON(gitea.event.changes.added_labels), 'ai-review')
-    runs-on: ubuntu-latest
-
-    env:
-      AI_REVIEW_CONFIG_FILE_YAML: ./shared-prompts/iac/.ai-review.yaml
-      # VCS configuration
-      VCS__PROVIDER: GITEA
-      VCS__PIPELINE__OWNER: ${{ github.repository_owner }}
-      VCS__PIPELINE__REPO: ${{ github.event.repository.name }}
-      VCS__PIPELINE__PULL_NUMBER: ${{ github.event.pull_request.number }}
-      VCS__HTTP_CLIENT__API_URL: https://git.forteapps.net/api/v1
-      VCS__HTTP_CLIENT__API_TOKEN: ${{ secrets.AI_REVIEW_TOKEN }}
-      # Review — disable fallback to see real Gitea API errors
-      REVIEW__INLINE_COMMENT_FALLBACK: "false"
-      # LLM configuration
-      LLM__PROVIDER: CLAUDE
-      LLM__META__MODEL: claude-sonnet-4-20250514
-      LLM__META__MAX_TOKENS: "4096"
-      LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
-      LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-      with:
-        submodules: true
-        fetch-depth: 0
-        token: ${{ secrets.AI_REVIEW_TOKEN }}
-
-    - name: Run inline review
-      uses: docker://nikitafilonov/ai-review:v0.64.0
-      with:
-        args: ai-review run-inline
-
-    - name: Run summary review
-      uses: docker://nikitafilonov/ai-review:v0.64.0
-      with:
-        args: ai-review run-summary
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@
 # User-specific files (MonoDevelop/Xamarin Studio)
 *.userprefs

+.github/
 private/
 .helm/
 temp/
@@ -14,5 +15,4 @@ CLAUDE.md
 .claude/
 devbox.d/
 devbox.lock
-.devbox/
-bash.exe.stackdump
+.devbox/
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +0,0 @@
-[submodule "shared-prompts"]
-	path = shared-prompts
-	url = https://git.forteapps.net/Forte/ai-review-prompts.git
--- a/README.md
+++ b/README.md
@@ -1,9 +1,9 @@
 # Kubernetes Cluster - GitOps Configuration

-> **Kubernetes cluster bootstrapping and GitOps configuration repository** using ArgoCD for multi-cloud Kubernetes (UpCloud, AWS EKS, Azure AKS, GCP GKE)
+> **Kubernetes cluster bootstrapping and GitOps configuration repository** using ArgoCD for UpCloud Managed Kubernetes

 [![GitOps](https://img.shields.io/badge/GitOps-ArgoCD-blue)](https://argoproj.github.io/cd/)
-[![Kubernetes](https://img.shields.io/badge/Kubernetes-Multi--Cloud-orange)]()
+[![Kubernetes](https://img.shields.io/badge/Kubernetes-UpCloud-orange)](https://upcloud.com/)

 ---

@@ -27,8 +27,8 @@
 ### For New Developers
 ```bash
 # 1. Clone repositories
-git clone https://git.forteapps.net/Forte/launchpad.git
-git clone ssh://git@git.forteapps.net:2222/Forte/helm-prod-values.git
+git clone https://github.com/fortedigital/sturdy-adventure.git
+git clone git@github.com:fortedigital/helm-values.git

 # 2. Read the guides
 # - Start: docs/GITOPS-ARCHITECTURE.md
@@ -57,10 +57,10 @@ This repository contains the complete GitOps configuration for our Kubernetes cl

 ### What's Inside

- **Infrastructure Applications**: Traefik, Cert-Manager, Kyverno, Prometheus, Grafana, Loki, Tempo, Sealed Secrets, Homepage (platform dashboard)
+- **Infrastructure Applications**: Traefik, Cert-Manager, Kyverno, Prometheus, Grafana, Loki, Sealed Secrets
 - **Business Applications**: MCP10X, MusicMan, Dot-AI Stack, ArgoCD MCP
 - **Policies**: Kyverno security policies for secret management, namespace controls, pod verification
- **Monitoring**: Full observability stack with metrics, logs, traces, and alerting
+- **Monitoring**: Full observability stack with metrics, logs, and alerting
 - **Secrets**: Sealed Secrets for secure Git storage

 ### Key Features
@@ -72,7 +72,7 @@ This repository contains the complete GitOps configuration for our Kubernetes cl
 ✅ **Policy Enforcement**: Kyverno ensures security and compliance
 ✅ **Authentication**: Automatic sidecar injection (token & OIDC support)
 ✅ **TLS Everywhere**: Automatic Let's Encrypt certificates
-✅ **Full Observability**: Prometheus, Grafana, Loki, Tempo integration
+✅ **Full Observability**: Prometheus, Grafana, Loki integration

 ---

@@ -83,52 +83,24 @@ This repository contains the complete GitOps configuration for our Kubernetes cl
 ├── bootstrap.sh                # Cluster initialization script
 ├── _app-of-apps.yaml          # Root ArgoCD Application (App-of-Apps pattern)
 │
-├── infra/                     # Infrastructure ArgoCD Applications (Kustomize multi-cluster)
-│   ├── base/                  # Base ArgoCD Application manifests (one dir per component)
-│   │   ├── kustomization.yaml # Aggregates all component subdirectories
-│   │   ├── traefik-application/
-│   │   │   ├── kustomization.yaml
-│   │   │   └── traefik-application.yaml
-│   │   ├── keycloak/
-│   │   │   ├── kustomization.yaml
-│   │   │   └── keycloak.yaml
-│   │   ├── grafana/
-│   │   ├── prometheus/
-│   │   ├── ...               # Each component in its own subdirectory
-│   │   └── secrets/
-│   ├── overlays/              # Per-cluster overrides (Kustomize)
-│   │   ├── upc-dev/           # UpCloud Dev — includes all base components
-│   │   ├── upc-prod/         # UpCloud Prod — all components + patches
-│   │   ├── aks-dev/          # Azure AKS Dev — selective components only
-│   │   ├── aks-prod/         # Azure AKS Prod
-│   │   ├── eks-dev/           # AWS EKS Dev
-│   │   ├── eks-prod/         # AWS EKS Prod
-│   │   ├── gke-dev/          # GCP GKE Dev
-│   │   └── gke-prod/         # GCP GKE Prod
-│   ├── dashboards/            # Grafana dashboard ConfigMaps
+├── infra/                     # Infrastructure ArgoCD Applications
+│   ├── enterprise-apps.yaml   # Manages all apps in apps/ folder
+│   ├── traefik-application.yaml
+│   ├── cert-manager-application.yaml
+│   ├── kyverno.yaml
+│   ├── prometheus.yaml
+│   ├── grafana.yaml
+│   ├── loki.yaml
+│   ├── fluent-bit.yaml
+│   ├── trivy.yaml
+│   ├── sealedsecrets.yaml
 │   └── values/                # Helm value overrides
-│       ├── base/              # Shared cloud-agnostic values
-│       ├── upc-dev/           # UpCloud Dev (storage, LB, pricing)
-│       ├── upc-prod/         # UpCloud Prod
-│       ├── eks-dev/           # AWS EKS Dev
-│       ├── eks-prod/         # AWS EKS Prod
-│       ├── aks-dev/        # Azure AKS Dev
-│       ├── aks-prod/       # Azure AKS Prod
-│       ├── gke-dev/          # GCP GKE Dev
-│       └── gke-prod/         # GCP GKE Prod
 │
-├── apps/                      # Business Applications (Kustomize, same pattern as infra)
-│   ├── base/                  # One subdirectory per app
-│   │   ├── kustomization.yaml
-│   │   ├── musicman/
-│   │   ├── mcp10x/
-│   │   ├── dot-ai-stack/
-│   │   ├── ts-mcp/
-│   │   └── argo-mcp/
-│   └── overlays/              # Per-cluster: cherry-pick or include all
-│       ├── upc-dev/           # All apps
-│       ├── upc-prod/         # All apps + patches
-│       └── aks-dev/          # Selective apps only
+├── apps/                      # Business Applications
+│   ├── mcp10x.yaml
+│   ├── musicman.yaml
+│   ├── dot-ai-stack.yaml
+│   └── argo-mcp.yaml
 │
 ├── cluster-resources/         # Cluster-wide Kubernetes resources
 │   ├── letsencrypt-issuer.yaml
@@ -164,14 +136,14 @@ This repository contains the complete GitOps configuration for our Kubernetes cl

 | Repository | Purpose | Who Edits | How Often |
 |------------|---------|-----------|-----------|
-| **[launchpad](https://git.forteapps.net/Forte/launchpad)** (this repo) | ArgoCD Applications, cluster resources | Platform / DevOps engineers | ✅ Often |
-| **[forte-helm](https://git.forteapps.net/Forte/forte-helm)** | Generic Helm chart templates | Platform engineers | ❌ Rarely |
-| **[helm-prod-values](ssh://git@git.forteapps.net:2222/Forte/helm-prod-values.git)** | App-specific configuration & versions | Developers / CI pipelines | ✅ Sometimes |
+| **[sturdy-adventure](https://github.com/fortedigital/sturdy-adventure.git)** (this repo) | ArgoCD Applications, cluster resources | Platform / DevOps engineers | ✅ Often |
+| **[forte-helm](https://github.com/snothub/forte-helm)** | Generic Helm chart templates | Platform engineers | ❌ Rarely |
+| **[helm-values](git@github.com:fortedigital/helm-values.git)** | App-specific configuration & versions | Developers / CI pipelines | ✅ Sometimes |

 ### GitOps Workflow

 ```
-Developer commits code → CI/CD builds image → Updates helm-prod-values → ArgoCD syncs → Deployed to cluster
+Developer commits code → CI/CD builds image → Updates helm-values → ArgoCD syncs → Deployed to cluster
 ```

 **Learn more**: [GitOps Architecture - GitOps Workflow](docs/GITOPS-ARCHITECTURE.md#gitops-workflow)
@@ -186,7 +158,7 @@ Developer commits code → CI/CD builds image → Updates helm-prod-values → A

 **Quick version**:
 1. Create `apps/myapp.yaml` (ArgoCD Application manifest)
-2. Create `helm-prod-values/myapp/values.yaml` (configuration)
+2. Create `helm-values/myapp/values.yaml` (configuration)
 3. Create sealed secrets if needed
 4. Commit and push - ArgoCD auto-syncs!

@@ -195,8 +167,8 @@ Developer commits code → CI/CD builds image → Updates helm-prod-values → A
 **See detailed guide**: [Developer Guide - Updating an Existing Application](docs/DEVELOPER-GUIDE.md#updating-an-existing-application)

 **Quick version**:
- **Update code**: Push to app repo → CI/CD updates image tag in helm-prod-values
- **Update config**: Edit `helm-prod-values/myapp/values.yaml` → commit → push
+- **Update code**: Push to app repo → CI/CD updates image tag in helm-values
+- **Update config**: Edit `helm-values/myapp/values.yaml` → commit → push

 ### Manage Secrets

@@ -224,7 +196,7 @@ git push

 **Quick version**:
 ```yaml
-# In helm-prod-values/myapp/values.yaml
+# In helm-values/myapp/values.yaml

 # Token-based auth (simple)
 auth:
@@ -359,10 +331,8 @@ kubectl patch application myapp -n argocd \
 | **Prometheus** | Metrics | `monitoring` | 1 |
 | **Grafana** | Dashboards | `monitoring` | 1 |
 | **Loki** | Logs | `monitoring` | 1 |
-| **Tempo** | Distributed tracing | `monitoring` | 1 |
 | **Fluent-Bit** | Log shipping | `monitoring` | DaemonSet |
-| **OpenCost** | Cost monitoring | `monitoring` | 1 |
-| **Renovate** | Dependency updates | `renovate` | CronJob |
+| **Trivy** | Vulnerability scanning | `trivy-system` | 1 |

 **Full specs**: [Technical Reference - Infrastructure Components](docs/REFERENCE.md#infrastructure-components)

@@ -380,12 +350,12 @@ kubectl patch application myapp -n argocd \
 ## 📖 Key Concepts

 ### App-of-Apps Pattern
-`_app-of-apps-{cluster}.yaml` is the root Application that manages all other Applications in `infra/`. Each component in `infra/base/` lives in its own subdirectory (e.g., `infra/base/grafana/`). Overlays can either include **all** components (via `../../base`) or **cherry-pick** specific ones (via `../../base/grafana`, `../../base/prometheus`, etc.). Per-cluster patches swap Helm value file paths. Supported clusters: `upc-dev`, `upc-prod`, `eks-dev`, `eks-prod`, `aks-dev`, `aks-prod`, `gke-dev`, `gke-prod`.
+`_app-of-apps.yaml` is the root Application that manages all other Applications in `infra/`. Each YAML in `infra/` becomes a child Application managed by ArgoCD.

 ### Multi-Source Pattern
 Applications reference both:
 1. **Helm charts** from `forte-helm` (templates)
-2. **Values** from `helm-prod-values` (configuration)
+2. **Values** from `helm-values` (configuration)

 This separates reusable templates from environment-specific config.

@@ -454,7 +424,7 @@ Applications deploy in order using `argocd.argoproj.io/sync-wave`:
 ### Adding a New Application
 1. Read [Developer Guide - Deploying Your First Application](docs/DEVELOPER-GUIDE.md#deploying-your-first-application)
 2. Create ArgoCD Application manifest in `apps/`
-3. Create Helm values in `helm-prod-values/`
+3. Create Helm values in `helm-values/`
 4. Create sealed secrets if needed
 5. Commit and push - ArgoCD handles the rest!

@@ -477,14 +447,16 @@ Documentation lives in `docs/`. To update:
 ## 📝 Notes

 ### Current Environment
- **Provider**: Multi-cloud (UpCloud, AWS EKS, Azure AKS, GCP GKE)
- **Active clusters**: UpCloud (upc-dev, upc-prod)
+- **Provider**: UpCloud Managed Kubernetes
 - **Environment**: Production (internal use only)
+- **Cluster**: Single cluster
 - **Auth**: Disabled for ArgoCD (internal access)
- **Backup**: Gitea daily backup to S3-compatible storage
+- **Backup**: None (cluster rebuildable via GitOps)

 ### Known Limitations
+- No automated backups (yet)
 - Secret rotation not automated
+- Single cluster (no multi-cluster setup)
 - DNS management is manual

 **Future improvements**: See [Operations Runbook - Disaster Recovery](docs/OPERATIONS-RUNBOOK.md#disaster-recovery)
@@ -498,12 +470,11 @@ Documentation lives in `docs/`. To update:
 - [Kyverno Documentation](https://kyverno.io/docs/)
 - [Traefik Documentation](https://doc.traefik.io/traefik/)
 - [Cert-Manager Documentation](https://cert-manager.io/docs/)
- [Grafana Tempo Documentation](https://grafana.com/docs/tempo/)
 - [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets)

 ### Related Repositories
- [forte-helm](https://git.forteapps.net/Forte/forte-helm) - Helm chart templates
- [helm-prod-values](git@github.com:fortedigital/helm-prod-values.git) - Application values
+- [forte-helm](https://github.com/snothub/forte-helm) - Helm chart templates
+- [helm-values](git@github.com:fortedigital/helm-values.git) - Application values

 ---

@@ -521,7 +492,7 @@ Internal use only. Not for public distribution.

 ---

-**Last Updated**: 2026-04-22
+**Last Updated**: 2026-03-16
 **Documentation Version**: 1.0.0

 **🚀 Ready to get started? Check out the [Documentation Index](docs/README.md)!**
--- a/_app-of-apps-aks-dev.yaml
+++ b/_app-of-apps-aks-dev.yaml
@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infrastructure-apps
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: infrastructure-apps
-    app.kubernetes.io/part-of: platform
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    path: infra/overlays/aks-dev
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
--- a/_app-of-apps-aks-prod.yaml
+++ b/_app-of-apps-aks-prod.yaml
@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infrastructure-apps
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: infrastructure-apps
-    app.kubernetes.io/part-of: platform
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    path: infra/overlays/aks-prod
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
--- a/_app-of-apps-eks-prod.yaml
+++ b/_app-of-apps-eks-prod.yaml
@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infrastructure-apps
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: infrastructure-apps
-    app.kubernetes.io/part-of: platform
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    path: infra/overlays/eks-prod
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
--- a/_app-of-apps-gke-dev.yaml
+++ b/_app-of-apps-gke-dev.yaml
@@ -18,9 +18,9 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
-    path: infra/overlays/gke-dev
+    path: infra/overlays/eu
  destination:
    server: https://kubernetes.default.svc
    namespace: default
--- a/_app-of-apps-gke-prod.yaml
+++ b/_app-of-apps-gke-prod.yaml
@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infrastructure-apps
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: infrastructure-apps
-    app.kubernetes.io/part-of: platform
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    path: infra/overlays/gke-prod
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
--- a/_app-of-apps-upc-dev.yaml
+++ b/_app-of-apps-upc-dev.yaml
@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infrastructure-apps
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: infrastructure-apps
-    app.kubernetes.io/part-of: platform
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    path: infra/overlays/upc-dev
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
--- a/_app-of-apps-upc-prod.yaml
+++ b/_app-of-apps-upc-prod.yaml
@@ -1,32 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infrastructure-apps
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: infrastructure-apps
-    app.kubernetes.io/part-of: platform
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    path: infra/overlays/upc-prod
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
--- a/_app-of-apps-eks-dev.yaml
+++ b/_app-of-apps-eks-dev.yaml
@@ -18,9 +18,9 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
-    path: infra/overlays/eks-dev
+    path: infra/overlays/us
  destination:
    server: https://kubernetes.default.svc
    namespace: default
--- a/apps/base/argo-mcp/argo-mcp.yaml
+++ b/apps/base/argo-mcp/argo-mcp.yaml
@@ -16,14 +16,14 @@ metadata:
 spec:
  project: default
  sources:
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/forte-helm.git
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp
    targetRevision: HEAD
    helm:
      valueFiles:
      - $values/argocd-mcp/values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    targetRevision: HEAD
    ref: values

--- a/apps/base/argo-mcp/kustomization.yaml
+++ b/apps/base/argo-mcp/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- argo-mcp.yaml
- argocdmcp-auth-oidc-sealed.yaml
- argocd-mcp-credentials.yaml
--- a/apps/base/dot-ai-stack/dot-ai-stack.yaml
+++ b/apps/base/dot-ai-stack/dot-ai-stack.yaml
@@ -35,9 +35,9 @@ spec:
      releaseName: dot-ai-stack
      valueFiles:
      - $values/infra/values/base/dot-ai-stack-values.yaml
-      - $values/infra/values/upc-dev/dot-ai-stack-values.yaml
+      - $values/infra/values/eu/dot-ai-stack-values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    ref: values

--- a/apps/base/dot-ai-stack/kustomization.yaml
+++ b/apps/base/dot-ai-stack/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- dot-ai-stack.yaml
- dot-ai-secrets.yaml
--- a/apps/base/kustomization.yaml
+++ b/apps/base/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- dot-ai-stack
- mcp10x
- musicman
- ts-mcp
- argo-mcp
+- dot-ai-stack.yaml
+- mcp10x.yaml
+- musicman.yaml
+- mcpcoder.yaml
+- argo-mcp.yaml
--- a/apps/base/mcp10x/mcp10x.yaml
+++ b/apps/base/mcp10x/mcp10x.yaml
@@ -17,14 +17,14 @@ metadata:
 spec:
  project: default
  sources:
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/forte-helm.git
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp
    targetRevision: HEAD
    helm:
      valueFiles:
      - $values/mcp10x/values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    targetRevision: HEAD
    ref: values

--- a/apps/base/mcp10x/kustomization.yaml
+++ b/apps/base/mcp10x/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- mcp10x.yaml
- forte10x-app-credentials-sealed.yaml
--- a/apps/base/ts-mcp/ts-mcp.yaml
+++ b/apps/base/ts-mcp/ts-mcp.yaml
@@ -1,15 +1,15 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: ts-mcp
+  name: mcpcoder
  namespace: argocd
  annotations:
-    argocd.argoproj.io/sync-wave: "11"
+    argocd.argoproj.io/sync-wave: "1"
    notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
    notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
    notifications.argoproj.io/subscribe.on-degraded.slack: ""
  labels:
-    app.kubernetes.io/name: ts-mcp
+    app.kubernetes.io/name: mcpcoder
    app.kubernetes.io/part-of: apps
    app.kubernetes.io/managed-by: argocd
  finalizers:
@@ -17,21 +17,20 @@ metadata:
 spec:
  project: default
  sources:
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/forte-helm.git
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp
    targetRevision: HEAD
    helm:
      valueFiles:
-      - $values/ts-mcp/values.yaml
+      - $values/mcpcoder/values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    targetRevision: HEAD
    ref: values

  destination:
    server: https://kubernetes.default.svc
-    namespace: ts-mcp
-
+    namespace: mcpcoder
  syncPolicy:
    automated:
      prune: true
--- a/apps/base/musicman/musicman.yaml
+++ b/apps/base/musicman/musicman.yaml
@@ -17,14 +17,14 @@ metadata:
 spec:
  project: default
  sources:
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/forte-helm.git
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp
    targetRevision: HEAD
    helm:
      valueFiles:
      - $values/musicman/values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    targetRevision: HEAD
    ref: values

@@ -36,8 +36,13 @@ spec:
    automated:
      prune: true
      selfHeal: true
+      allowEmpty: false
+
    syncOptions:
    - CreateNamespace=true
+    - Validate=true
+    - ServerSideApply=false
+    - Replace=false
    retry:
      limit: 5
      backoff:
--- a/apps/base/musicman/kustomization.yaml
+++ b/apps/base/musicman/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- musicman.yaml
- musicman-credentials.yaml
--- a/apps/base/ts-mcp/kustomization.yaml
+++ b/apps/base/ts-mcp/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ts-mcp.yaml
- ts-mcp-secrets-sealed.yaml
--- a/apps/base/ts-mcp/ts-mcp-secrets-sealed.yaml
+++ b/apps/base/ts-mcp/ts-mcp-secrets-sealed.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: ts-mcp-secrets
-  namespace: ts-mcp
-spec:
-  encryptedData:
-    AZURE_CLIENT_SECRET: AgCWj525+NHkZ8XG97hEe4RS0SDC0QIGDXmEvzSlIqJQ9XVZEeKxVuAYmJ+w/HH7zBXD3qlZISeOPKn3FbMEeRukmYK0d5PsH26tRUMPoMzwWCuQkZIQ83uX9Pz/wMiqW8aZFIxpdEiUgVdanxHSFoDRPC1VlSEtV9B9yN2MgXBID5s0oje5BM9ttc4WVRe6+9pMeaOC6u+YUgcfY7xPLetZfC9nQO4zn4jYhoQXfAddwMzNODvQNGPzIv6PXDXJweTwdmtGaxM6eDdcCJI/30bEV9prA5m6UlgTZ/Qp+onU70KdkBA9gM9tMMVUR6j/2sbWzqMP/rVaFLeUH1PjHv15n4EieWyuDyYEfmZNDFXc7O9RIK6P0jCIE+t3myxK2ZQ7cfXprdOSj94au0qP6leat0UUVoc9CFJHHtrNxXYWl7IYVhwvIQCMSgO2qoAXkdW4wKVJAcbJadJjoL2pWxzjaD4GgnUaAxWBANqZI2lD8CED4VfUVMB0ZUYRS/zvy/eqIGlT8WbzwTYFi3YDZRvAUIknxaWEavIG4x52d0FqTmFYY06W53fGYfBrUjJI54GWYyBpKdZTf7b/AlAN0+kwkk6OqsUWwWDqxR7LVCcPhjSIKd/THp+Tbq9z5TiPIHxOO9V60u51f8IoQrEgQfNov7CEGQZ8B9HUGObjNc5MhujzBJasMhrUcd2Ddk6KWk07B7223p/gIEM+81ZWQYUcc29+U/j1dQyRNZy/TC56ywe5DDBJSoGp
-  template:
-    metadata:
-      name: ts-mcp-secrets
-      namespace: ts-mcp
--- a/apps/overlays/aks-dev/kustomization.yaml
+++ b/apps/overlays/aks-dev/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ../../base/musicman
--- a/apps/overlays/eu/kustomization.yaml
+++ b/apps/overlays/eu/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../base
+
+# No patches needed — base already has "eu" paths
+# EU is the default/base cluster
--- a/apps/overlays/upc-dev/kustomization.yaml
+++ b/apps/overlays/upc-dev/kustomization.yaml
@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ../../base
-
-# No patches needed — base already has "upc-dev" paths
-# upc-dev is the default/base cluster
--- a/apps/overlays/upc-prod/kustomization.yaml
+++ b/apps/overlays/upc-prod/kustomization.yaml
@@ -4,11 +4,11 @@ resources:
 - ../../base

 patches:
-# dot-ai-stack: swap upc-dev → upc-prod
+# dot-ai-stack: swap eu → us
 - target:
    kind: Application
    name: dot-ai-stack
  patch: |
    - op: replace
      path: /spec/sources/0/helm/valueFiles/1
-      value: $values/infra/values/upc-prod/dot-ai-stack-values.yaml
+      value: $values/infra/values/us/dot-ai-stack-values.yaml
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -1,9 +1,8 @@
 #!/bin/zsh
-
 # in case of  $'\r': command not found error, run command below first
 # sed -i 's/\r$//' ./bootstrap.sh

-CLUSTER="${1:?Usage: ./bootstrap.sh <cluster> (upc-dev|upc-prod|aks-dev|aks-prod|eks-dev|eks-prod|gke-dev|gke-prod)}"
+CLUSTER="${1:?Usage: ./bootstrap.sh <cluster> (eu|us)}"

 echo "running $0 for cluster: ${CLUSTER}..."

@@ -18,18 +17,18 @@ echo "Bootstrapping cluster: ${clusterName} (${CLUSTER})..."
 Bootstrap()
 {
    ArgoCd
-    Gitea
+    Github
 }


 ############################################################
-# Gitea                                                     #
+# Github                                                     #
 ############################################################
-Gitea()
+Github()
 {
    echo "Installing secret..."
-    kubectl apply -f "private/${CLUSTER}/gitea-repo-main.yaml"
-    kubectl apply -f "private/${CLUSTER}/main.key"
+    kubectl apply -f private/github-${CLUSTER}.yaml
+    kubectl apply -f private/main-${CLUSTER}.key
 }

 ############################################################
@@ -37,15 +36,10 @@ Gitea()
 ############################################################
 ArgoCd()
 {
-    # Pre-create ConfigMap for repo-server env (must exist before Helm upgrade)
-    kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
-    kubectl apply -f cluster-resources/argocd-repo-server-config.yaml
-
    # install argocd
    echo "Installing ArgoCD..."
    helm upgrade --install argocd argo-cd \
            --repo https://argoproj.github.io/argo-helm \
-            --version "7.8.0" \
            --namespace argocd --create-namespace \
            --values infra/values/base/argocd-values.yaml \
            --values "infra/values/${CLUSTER}/argocd-values.yaml" \
@@ -55,4 +49,4 @@ ArgoCd()
    kubectl apply -f "_app-of-apps-${CLUSTER}.yaml" -n argocd
 }

-Bootstrap
+# Bootstrap
--- a/cluster-resources/argocd-oidc-secret-sync.yaml
+++ b/cluster-resources/argocd-oidc-secret-sync.yaml
@@ -1,83 +0,0 @@
-# CronJob: syncs OIDC client secret from registrar-managed
-# argocd-oidc-credentials into argocd-secret (oidc.clientSecret key).
-# Runs every 2 min. No-ops if source secret doesn't exist yet
-# (safe for fresh deploys before Keycloak is up).
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: argocd-oidc-sync
-  namespace: argocd
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: argocd-oidc-sync
-  namespace: argocd
-rules:
- apiGroups: [""]
-  resources: ["secrets"]
-  resourceNames: ["argocd-oidc-credentials", "argocd-secret"]
-  verbs: ["get", "patch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: argocd-oidc-sync
-  namespace: argocd
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: argocd-oidc-sync
-subjects:
- kind: ServiceAccount
-  name: argocd-oidc-sync
-  namespace: argocd
---
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: argocd-oidc-sync
-  namespace: argocd
-spec:
-  schedule: "*/2 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 1
-      template:
-        spec:
-          serviceAccountName: argocd-oidc-sync
-          restartPolicy: Never
-          containers:
-          - name: sync
-            image: bitnami/kubectl:latest
-            command: ["/bin/sh", "-c"]
-            args:
-            - |
-              set -e
-
-              # Exit gracefully if source secret doesn't exist yet
-              if ! kubectl get secret argocd-oidc-credentials -n argocd >/dev/null 2>&1; then
-                echo "argocd-oidc-credentials not found — skipping (Keycloak not ready yet)"
-                exit 0
-              fi
-
-              # Read current OIDC client secret
-              NEW_SECRET=$(kubectl get secret argocd-oidc-credentials -n argocd \
-                -o jsonpath='{.data.client-secret}' | base64 -d)
-
-              # Read current value in argocd-secret (if any)
-              CURRENT=$(kubectl get secret argocd-secret -n argocd \
-                -o jsonpath='{.data.oidc\.clientSecret}' 2>/dev/null | base64 -d || echo "")
-
-              # Only patch if changed
-              if [ "$NEW_SECRET" = "$CURRENT" ]; then
-                echo "oidc.clientSecret already up to date"
-                exit 0
-              fi
-
-              kubectl patch secret argocd-secret -n argocd --type merge \
-                -p "{\"stringData\":{\"oidc.clientSecret\":\"${NEW_SECRET}\"}}"
-              echo "Patched argocd-secret with oidc.clientSecret"
--- a/cluster-resources/argocd-repo-server-config.yaml
+++ b/cluster-resources/argocd-repo-server-config.yaml
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-repo-server-config
-  namespace: argocd
-data:
-  # Disable git submodule checkout - submodules (e.g. shared-prompts)
-  # are not needed for K8s manifest generation
-  ARGOCD_GIT_MODULES_ENABLED: "false"
--- a/cluster-resources/gitea-backup-cronjob.yaml
+++ b/cluster-resources/gitea-backup-cronjob.yaml
@@ -1,88 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: gitea-backup
-  namespace: gitea
-spec:
-  schedule: "0 3 * * *"   # daily at 03:00 UTC
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 1
-      activeDeadlineSeconds: 1800
-      template:
-        spec:
-          restartPolicy: Never
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            fsGroup: 1000
-          # Must run on the same node as Gitea to share the RWO volume
-          affinity:
-            podAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                - labelSelector:
-                    matchLabels:
-                      app.kubernetes.io/name: gitea
-                  topologyKey: kubernetes.io/hostname
-          initContainers:
-            - name: gitea-dump
-              image: gitea/gitea:1.25.4
-              command:
-                - sh
-                - -c
-                - |
-                  gitea dump \
-                    -c /data/gitea/conf/app.ini \
-                    -f /backup/gitea-dump.zip \
-                    -t /tmp/gitea-dump && \
-                  echo "Dump completed: $(ls -lh /backup/gitea-dump.zip)"
-              volumeMounts:
-                - name: data
-                  mountPath: /data
-                  readOnly: true
-                - name: backup
-                  mountPath: /backup
-                - name: tmp
-                  mountPath: /tmp/gitea-dump
-          containers:
-            - name: upload
-              image: minio/mc:latest
-              env:
-                - name: HOME
-                  value: /tmp
-              command:
-                - sh
-                - -c
-                - |
-                  mc alias set s3 "${S3_ENDPOINT}" "${AWS_ACCESS_KEY_ID}" "${AWS_SECRET_ACCESS_KEY}"
-
-                  TIMESTAMP=$(date +%Y%m%d-%H%M%S)
-                  KEY="gitea-dump-${TIMESTAMP}.zip"
-                  echo "Uploading ${KEY}..."
-                  mc cp /backup/gitea-dump.zip "s3/${S3_BUCKET}/${KEY}" && \
-                  echo "Upload complete."
-
-                  # Prune backups older than 7 days
-                  echo "Pruning backups older than 7 days..."
-                  mc rm --older-than 7d --force "s3/${S3_BUCKET}/" 2>&1 || true
-                  echo "Pruning complete."
-              envFrom:
-                - secretRef:
-                    name: gitea-backup-s3
-              volumeMounts:
-                - name: backup
-                  mountPath: /backup
-                  readOnly: true
-          volumes:
-            - name: data
-              persistentVolumeClaim:
-                claimName: gitea-shared-storage
-            - name: backup
-              emptyDir:
-                sizeLimit: 5Gi
-            - name: tmp
-              emptyDir:
-                sizeLimit: 5Gi
--- a/cluster-resources/gitea-ssh-ingressroute.yaml
+++ b/cluster-resources/gitea-ssh-ingressroute.yaml
@@ -1,13 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
-metadata:
-  name: gitea-ssh
-  namespace: gitea
-spec:
-  entryPoints:
-    - giteassh
-  routes:
-    - match: HostSNI(`*`)
-      services:
-        - name: gitea-ssh
-          port: 22
--- a/cluster-resources/network/deny-external-egress-trivy.yaml
+++ b/cluster-resources/network/deny-external-egress-trivy.yaml
@@ -1,37 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: deny-external-egress
-  namespace: trivy-system
-  labels:
-    app.kubernetes.io/managed-by: argocd
-    app.kubernetes.io/part-of: network-policies
-spec:
-  endpointSelector: {}
-  egress:
-    # Allow DNS resolution
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-
-    # Allow cluster-internal traffic (RFC1918)
-    - toCIDR:
-        - 10.0.0.0/8
-        - 172.16.0.0/12
-        - 192.168.0.0/16
-
-    # Allow Trivy vulnerability DB downloads (ghcr.io OCI registry)
-    - toFQDNs:
-        - matchName: ghcr.io
-        - matchName: pkg-containers.githubusercontent.com
-      toPorts:
-        - ports:
-            - port: "443"
-              protocol: TCP
--- a/cluster-resources/policies/auth-sidecar-injector.yaml
+++ b/cluster-resources/policies/auth-sidecar-injector.yaml
@@ -10,7 +10,7 @@ metadata:
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
-      Injects an auth sidecar container into Pods annotated with policies.forteapps.io/auth: "true". Supports three auth modes controlled by the policies.forteapps.io/auth-type annotation: "token" (default), "oidc", and "mcp". In token mode the sidecar reads credentials from a mounted Secret volume. In OIDC mode the sidecar uses OpenID Connect with authority and client-id provided via required annotations (policies.forteapps.io/auth-oidc-authority and policies.forteapps.io/auth-oidc-client-id) and secrets from an auth-oidc Secret. In MCP mode the sidecar implements OAuth 2.0 for MCP servers per RFC 9728 (Protected Resource Metadata) and RFC 7591 (Dynamic Client Registration), configured via policies.forteapps.io/auth-mcp-resource and policies.forteapps.io/auth-mcp-authority annotations. The sidecar port defaults to 9001 and can be overridden via the policies.forteapps.io/auth-port annotation. A NetworkPolicy is generated to restrict ingress to the sidecar port only.
+      Injects an auth sidecar container into Pods annotated with policies.forteapps.io/auth: "true". Supports three auth modes controlled by the policies.forteapps.io/auth-type annotation: "token" (default), "oidc", and "mcp". In token mode the sidecar reads credentials from a mounted Secret volume. In OIDC mode the sidecar uses OpenID Connect with authority and client-id provided via required annotations (policies.forteapps.io/auth-oidc-authority and policies.forteapps.io/auth-oidc-client-id) and secrets from an auth-oidc Secret. In MCP mode the sidecar implements OAuth 2.0 for MCP servers per RFC 9728 (Protected Resource Metadata) and RFC 7591 (Dynamic Client Registration), configured via policies.forteapps.io/auth-mcp-resource and policies.forteapps.io/auth-mcp-authority annotations. A NetworkPolicy is generated to restrict ingress to the sidecar port only.
 spec:
  background: false
  rules:
@@ -119,26 +119,21 @@ spec:
    - name: appPort
      variable:
        jmesPath: request.object.spec.containers[?name != 'authn'] | [0].ports[0].containerPort || `3000`
-    - name: sidecarPort
-      variable:
-        jmesPath: to_number(request.object.metadata.annotations."policies.forteapps.io/auth-port" || '9001')
    mutate:
      patchStrategicMerge:
        spec:
          containers:
          - name: authn
-            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'git.forteapps.net/forte/auth-sidecar' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
+            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'ghcr.io/snothub/stunning-memory' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
            ports:
-            - containerPort: "{{ sidecarPort }}"
+            - containerPort: 8080
              name: auth
              protocol: TCP
            env:
            - name: AUTH_LISTEN_ADDR
-              value: ":{{ sidecarPort }}"
+              value: ":8080"
            - name: AUTH_UPSTREAM_URL
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-upstream-url\" || join('', ['http://localhost:', to_string(appPort)]) }}"
-            - name: AUTH_PUBLIC_PATHS
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
            - name: AUTH_TOKEN_FILE
              value: "/etc/auth/tokens"
            - name: AUTH_MODE
@@ -157,13 +152,13 @@ spec:
            readinessProbe:
              httpGet:
                path: /healthz
-                port: "{{ sidecarPort }}"
+                port: 8080
              initialDelaySeconds: 2
              periodSeconds: 5
            livenessProbe:
              httpGet:
                path: /healthz
-                port: "{{ sidecarPort }}"
+                port: 8080
              initialDelaySeconds: 5
              periodSeconds: 10
            securityContext:
@@ -200,25 +195,22 @@ spec:
    - name: appPort
      variable:
        jmesPath: request.object.spec.containers[?name != 'authn'] | [0].ports[0].containerPort || `3000`
-    - name: sidecarPort
-      variable:
-        jmesPath: to_number(request.object.metadata.annotations."policies.forteapps.io/auth-port" || '9001')
    mutate:
      patchStrategicMerge:
        spec:
          containers:
          - name: authn
-            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'git.forteapps.net/forte/auth-sidecar' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
+            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'ghcr.io/snothub/stunning-memory' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
            imagePullPolicy: Always
            ports:
-            - containerPort: "{{ sidecarPort }}"
+            - containerPort: 8080
              name: auth
              protocol: TCP
            env:
            - name: AUTH_MODE
              value: "oidc"
            - name: AUTH_LISTEN_ADDR
-              value: ":{{ sidecarPort }}"
+              value: ":8080"
            - name: AUTH_LOG_LEVEL
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-log-level\" || 'info' }}"
            - name: AUTH_UPSTREAM_URL
@@ -233,8 +225,6 @@ spec:
              value: "{{ regex_replace_all('https?://[^/]*', request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-callback-path\", '') }}"
            - name: AUTH_OIDC_SCOPES
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-scopes\" || 'openid,profile,email'  }}"
-            - name: AUTH_PUBLIC_PATHS
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
            - name: AUTH_OIDC_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
@@ -243,8 +233,8 @@ spec:
            - name: AUTH_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
-                  name: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-credentials-secret\" || 'auth-oidc' }}"
-                  key: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-credentials-secret-key\" || 'client-secret' }}"
+                  name: auth-oidc
+                  key: client-secret
            resources:
              limits:
                cpu: 50m
@@ -255,13 +245,13 @@ spec:
            readinessProbe:
              httpGet:
                path: /healthz
-                port: "{{ sidecarPort }}"
+                port: 8080
              initialDelaySeconds: 2
              periodSeconds: 5
            livenessProbe:
              httpGet:
                path: /healthz
-                port: "{{ sidecarPort }}"
+                port: 8080
              initialDelaySeconds: 5
              periodSeconds: 10
            securityContext:
@@ -293,25 +283,22 @@ spec:
    - name: appPort
      variable:
        jmesPath: request.object.spec.containers[?name != 'authn'] | [0].ports[0].containerPort || `3000`
-    - name: sidecarPort
-      variable:
-        jmesPath: to_number(request.object.metadata.annotations."policies.forteapps.io/auth-port" || '9001')
    mutate:
      patchStrategicMerge:
        spec:
          containers:
          - name: authn
-            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'git.forteapps.net/forte/auth-sidecar' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
+            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'ghcr.io/snothub/stunning-memory' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
            imagePullPolicy: Always
            ports:
-            - containerPort: "{{ sidecarPort }}"
+            - containerPort: 8080
              name: auth
              protocol: TCP
            env:
            - name: AUTH_MODE
              value: "mcp"
            - name: AUTH_LISTEN_ADDR
-              value: ":{{ sidecarPort }}"
+              value: ":8080"
            - name: AUTH_LOG_LEVEL
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-log-level\" || 'info' }}"
            - name: AUTH_UPSTREAM_URL
@@ -320,10 +307,8 @@ spec:
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-mcp-resource\" }}"
            - name: AUTH_MCP_AUTHORIZATION_SERVERS
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-mcp-authority\" }}"
-            - name: AUTH_PUBLIC_PATHS
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
            - name: AUTH_MCP_SCOPES_SUPPORTED
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-mcp-scopes\" || 'profile'  }}"
+              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-mcp-scopes\" || 'read,write'  }}"
            resources:
              limits:
                cpu: 50m
@@ -334,106 +319,13 @@ spec:
            readinessProbe:
              httpGet:
                path: /healthz
-                port: "{{ sidecarPort }}"
+                port: 8080
              initialDelaySeconds: 2
              periodSeconds: 5
            livenessProbe:
              httpGet:
                path: /healthz
-                port: "{{ sidecarPort }}"
-              initialDelaySeconds: 5
-              periodSeconds: 10
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities:
-                drop:
-                - ALL
-  - name: inject-sidecar-oauth
-    skipBackgroundRequests: true
-    match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-          annotations:
-            policies.forteapps.io/auth: "true"
-            policies.forteapps.io/auth-type: "oauth"
-    exclude:
-      any:
-      - resources:
-          namespaces:
-          - kube-system
-          - kyverno
-          - argocd
-          - cert-manager
-          - monitoring
-    context:
-    - name: appPort
-      variable:
-        jmesPath: request.object.spec.containers[?name != 'authn'] | [0].ports[0].containerPort || `3000`
-    - name: sidecarPort
-      variable:
-        jmesPath: to_number(request.object.metadata.annotations."policies.forteapps.io/auth-port" || '9001')
-    mutate:
-      patchStrategicMerge:
-        spec:
-          containers:
-          - name: authn
-            image: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image\" || 'git.forteapps.net/forte/auth-sidecar' }}:{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-image-version\" || 'latest' }}"
-            imagePullPolicy: Always
-            ports:
-            - containerPort: "{{ sidecarPort }}"
-              name: auth
-              protocol: TCP
-            env:
-            - name: AUTH_MODE
-              value: "oauth"
-            - name: AUTH_LISTEN_ADDR
-              value: ":{{ sidecarPort }}"
-            - name: AUTH_LOG_LEVEL
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-log-level\" || 'info' }}"
-            - name: AUTH_UPSTREAM_URL
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-upstream-url\" || join('', ['http://localhost:', to_string(appPort)]) }}"
-            - name: AUTH_OAUTH_AUTHORITY
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-authority\" }}"
-            - name: AUTH_OAUTH_CLIENT_ID
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-client-id\" }}"
-            - name: AUTH_OAUTH_SCOPES
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-scopes\" || 'openid,profile,email'  }}"
-            - name: AUTH_OAUTH_DELEGATION_ENABLED
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-delegation-enabled\" || 'false'  }}"
-            - name: AUTH_OAUTH_DELEGATION_CLIENT_ID
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-delegation-client-id\" || ''  }}"
-            - name: AUTH_OAUTH_DELEGATION_SCOPES
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-delegation-scopes\" || ''  }}"
-            - name: AUTH_OAUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-credentials-secret\" || 'auth-oauth' }}"
-                  key: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oauth-credentials-secret-key\" || 'client-secret' }}"
-            - name: AUTH_OAUTH_DELEGATION_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: auth-oauth
-                  key: delegation-client-secret
-            resources:
-              limits:
-                cpu: 50m
-                memory: 64Mi
-              requests:
-                cpu: 10m
-                memory: 32Mi
-            readinessProbe:
-              httpGet:
-                path: /healthz
-                port: "{{ sidecarPort }}"
-              initialDelaySeconds: 2
-              periodSeconds: 5
-            livenessProbe:
-              httpGet:
-                path: /healthz
-                port: "{{ sidecarPort }}"
+                port: 8080
              initialDelaySeconds: 5
              periodSeconds: 10
            securityContext:
@@ -466,10 +358,6 @@ spec:
        operator: In
        value:
        - CREATE
-    context:
-    - name: sidecarPort
-      variable:
-        jmesPath: to_number(request.object.metadata.annotations."policies.forteapps.io/auth-port" || '9001')
    generate:
      synchronize: false
      apiVersion: networking.k8s.io/v1
@@ -488,5 +376,5 @@ spec:
          - Ingress
          ingress:
          - ports:
-            - port: "{{ sidecarPort }}"
+            - port: 8080
              protocol: TCP
--- a/cluster-resources/policies/deployment-verifier.yaml
+++ b/cluster-resources/policies/deployment-verifier.yaml
@@ -0,0 +1,71 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-deployment-owner
+spec:
+  validationFailureAction: Audit
+  background: false
+  rules:
+  - name: check-pod-owner-is-replicaset-from-deployment
+    skipBackgroundRequests: true
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    exclude:
+      any:
+      - resources:
+          namespaces:
+          - kube-system
+          - kyverno
+          - cert-manager
+          - monitoring
+          - argocd
+          - traefik-system
+    context:
+    - name: ownerReplicaSet
+      apiCall:
+        method: GET
+        urlPath: "/apis/apps/v1/namespaces/{{request.namespace}}/replicasets/{{request.object.metadata.ownerReferences[0].name}}"
+        jmesPath: "@"
+    preconditions:
+      all:
+      - key: "{{ request.object.metadata.ownerReferences || `[]` | [?kind=='ReplicaSet'] | length(@) }}"
+        operator: GreaterThanOrEquals
+        value: 1
+    validate:
+      allowExistingViolations: true
+      message: "Pods must be created through a Deployment resource."
+      deny:
+        conditions:
+          any:
+          - key: "{{ownerReplicaSet.metadata.ownerReferences[0].kind}}"
+            operator: NotEquals
+            value: Deployment
+  - name: deny-pods-without-replicaset-owner
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    exclude:
+      any:
+      - resources:
+          namespaces:
+          - kube-system
+          - kyverno
+          - cert-manager
+          - monitoring
+          - argocd
+          - traefik-system
+    skipBackgroundRequests: true
+    validate:
+      allowExistingViolations: true
+      message: "Direct pod creation is not allowed. Pods must come from a Deployment managed by ArgoCD."
+      deny:
+        conditions:
+          all:
+          - key: "{{ request.object.metadata.ownerReferences || `[]` | [?kind=='ReplicaSet'] | length(@) }}"
+            operator: LessThan
+            value: 1
--- a/cluster-resources/policies/keycloak-client-cloner.yaml
+++ b/cluster-resources/policies/keycloak-client-cloner.yaml
@@ -1,37 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: keycloak-client-config-cloner
-spec:
-  rules:
-  - name: clone-client-config-to-keycloak
-    skipBackgroundRequests: false
-    match:
-      any:
-      - resources:
-          kinds:
-          - Secret
-          selector:
-            matchLabels:
-              keycloak.forteapps.net/client-config: "true"
-    exclude:
-      any:
-      - resources:
-          namespaces:
-          - keycloak
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: "{{request.object.metadata.name}}"
-      namespace: keycloak
-      synchronize: true
-      data:
-        metadata:
-          labels:
-            keycloak.forteapps.net/client-config: "true"
-            keycloak.forteapps.net/source-namespace: "{{request.object.metadata.namespace}}"
-          annotations:
-            keycloak.forteapps.net/source-name: "{{request.object.metadata.name}}"
-            keycloak.forteapps.net/source-namespace: "{{request.object.metadata.namespace}}"
-        data: "{{request.object.data}}"
-        type: "{{request.object.type}}"
--- a/cluster-resources/policies/secret-cloner.yaml
+++ b/cluster-resources/policies/secret-cloner.yaml
@@ -16,6 +16,7 @@ spec:
      - resources:
          namespaces:
          - kube-system
+          - trivy-system
          - monitoring
          - argocd
          - cert-manager
--- a/cluster-resources/snothub-repo-credentials-sealed.yaml
+++ b/cluster-resources/snothub-repo-credentials-sealed.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: snothub-repo-creds
+  namespace: argocd
+spec:
+  encryptedData:
+    sshPrivateKey: AgCBd+i8jXBDwvWM0YC9OWvNTKyynVpW6hF0F3aH0GXBIYxzFo1g9kMajE/Ce3bTl8DiVs7VGzPdI6lmJtSC3+fVMm4wavDGrUUbhUHSR/HnEqq51NVjxU1Uj+VRz550z9r6gB0VLAcYqN0WLKd/4Qn7tvQOmKsaXMd5jsIYpSB8nZK87awZ5niFmT8DIKu2DOzoDBeN7Yqrf1aELq3m3kaDxGcDMYSglB0xRU3fF8FYr5inCic1eTrCUdfIwnrBSublNxI9FrGnlylRC40XCPxNpy6zyoQt7yeJTNgRSvtfceqXAwh25mcvga+BfDBTLPQ0EDbCoNDnE9EyMUa4kWcXBTFZ1Qx5NGRz8HAjWoYDbuNOonl9ik5dvv9UKKA+/04ZEuPjsbdkBq9xKuowx0zLL1IVv/jeuViFdvNY6LKNu/hLwMn8aMlTLlIkB+1fsIqV7Vkva9Vk7IXNz575lMwIGUTo1dsK9FQ5+uIe2bsRnY8RJ3lpyndZQ1HDPh7P7KZLZPH8fUuAHH1UF74njMQyve79zCRcisBAewpXdq4UsYAYUQOluS1Ak+sFcIdQ0jHjfklGCcJnTvMyO7obIsPQSv39/bsCqQX6uisrTzcb0s7wnbzhcxf1gm7IyZMIhi2Vub3GoLCIMnb6ViO8k+itLUa5eZpoEeg+BpP1mgL7O2nVfrZYgueULgMSvN89ct/THITsFAR8614An3DCHSnZLv5ZmY7yC6rmO405IlrnjvfFqEt9MdqTgR7uTYDSdI7UjIFJp3rchzikF1pSDMu/siKmD/Vi9+S0KqBcSENz7EUppVuYIk0aRBqHZ9Awoe0qPIjp1AMg947FjIYXzkGk3Kz0P85fGwkktyfHNZdIrXvpDAIP2739Mr7Hde+EHpuajrhuBgozfless5PqLFfGWFnt5COW2HrdSrvrY56MXuJUfiV0nq3eEhCju9f/cA41VbxfO0Hj+KMCjxiL+MCgIt1eWD24P7GQHb0D7+JiuwqgcH0ZqXRaKFYSOJ3/U1o9RRX9v5yebNTm8ErQTSnIN5bNRgE+t8CrTulGVcpaL/rW+XW8cO8MXLC/R4eeNwVjoiK4yXSHpSjf5dF9MZ6bS6SSZPMOa2besEzzQIj0c/EkUsp/GmIF1utDbJVI2VZLFGklwRo92OJs3URXNCqbzzgte43Y9dJp2VdWyi3Zx32pXVWaNdOzeifVOASP7ags7Kbdfvoaa5CmTu17iRUHCOv6164/KFeDCfY=
+    type: AgCIKe+SzLHIp+6gjOVbD7wcpZkeg5UwgXabFjtonavkPbzX+txHWN7IH2HbDmd7TdpgGFiqMGFSQC8mOVXnj+Pw1XnI8trH6wavvKjQ1SsRWteB8o7lGe2PcG2h2v5yW2vk5rrmuB0ehogeJez3ynlk508HguRtidzxnKdZyc6SHOh2hbWq1clspJicREsHlz3Rfn7upOSUyFmx+Tilfnjuom5FFYGBNZt0aEjaW5S7fjcYJBTEerjGjTz3vUs2DK3C5ymyCKKasA628fVZ20uIZhmn5NUGGK6bKDusFOQhYjRnxRYwS2fToBHiVfC8wo7bWW8ZwOrbguvedJU2q9pwjKvXy9upw8Ra3EcYzXASqwI6rqUQv6htGqzTYtVkRsdVxaQqITc3FYrhKIroru4Iup4xYtcVojppz0+HQxiv5WtxosVtfXXX4Zj4spr9ThoZgzLe3ebILEIK3wJNmK/AxV80NXq7JOI6gaiLK/fbm7gd9G7oW9VuM50OJELDmR4jU2k1KSx6sD5lB+c+Ajp1iw+iS9ETD/je93+eyBRKGM9fqP0+DpNsJBBlVLuWK/BwidBN186pFi4DlMzo13Wd0zYKQce4NVrf5s4f7T01KeBU+nnvvcuI+rW7tsY3R18zgP9D9uX2E5066qJQdrFov2YuXwovS4hCQDttIfz9YoGUKKQ3PObWUVynhtBptoGbhRw=
+    url: AgCjVnAWNarZplxbAurz++eBiKXIuYUcoleDcsrMdwdflBOOf6ayguCr7CDHzUbuKFnlNKoFvIvjUOqFb1v5Yy4iWju3ajvlo+ncEIezxetYOmQSft3nSeOD3+RCZn4Qf4K2C1D113IyPCo7T2h01KuVLWOItfuWuVwFDpLTvmKfTRAs8eP1L4ohvAcY0/J5mAmi7tXV2hN1r9R2MEuvHOusujtrRqewXHhzBksSb9/wxilruU/BHQAhYKeKHzi7QoIOeXJTnGEYxuTvskwKQhschIOIBPAOLaUbgKkuHuDIf8y1Gv2b8ENu5uNvTb/ZD43jtmx9P4pS+Hwc7OW411TrkRO7XbV7qo/PqYGYpkKYDK4g7ONGnzrsmXbSmip34vXll/jAknY61QQ6D6JbbONw/psX72p+ZFvOedhlKbHRuUnDYXyQgKFWBODLb63RaMYai79qbv8mJcwDLJaPXYXpwLumHeZX91uPPjahxfvOe8VoryTpvHIbxJO85VJJ1q+7uyFy6h7LVLhifYSbb+M55p/e5Ds5gNcgUv6npPUHdbf0yjYbT1tXGjhaqk4Tx93WoOKPQ/j+nPB41akooY0YfL/ZTDzr2iCMByrx/uPQz3JE+m7VrH5BZyYjj9sSASVsULabJGFiSuGpD+u/lcUNJW+WHQetMEU7+wNo/WB3E5iG9J8qPSPFcTiTslEa8cvGPNtNgyCQ2PphlinscQsvcAQ+ALtEd1dWXPhIGbF8udK6Wx6NYt8=
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: snothub-repo-creds
+      namespace: argocd
+    type: Opaque
--- a/clusters/aks-dev.yaml
+++ b/clusters/aks-dev.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: k8s-launchpad # → infra/values/aks-dev/argocd-values.yaml (notifications.context.clusterName)
-domain: example.com # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.example.com # → infra/values/aks-dev/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.example.com # → infra/values/aks-dev/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.example.com # → infra/values/aks-dev/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.example.com # → infra/values/aks-dev/dot-ai-stack-values.yaml (dot-ai.ingress.host) — create if needed
-dotaiUiDomain: kubemcpui.example.com # → infra/values/aks-dev/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host) — create if needed
-letsencryptEmail: admin@example.com # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "10.0.0.0/8,168.63.129.16/32" # → infra/values/aks-dev/traefik-values.yaml (ports.*.trustedIPs) — VNet CIDR + Azure health probe
-cloudProvider: azure # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/aks-prod.yaml
+++ b/clusters/aks-prod.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: prod-aks                    # → infra/values/aks-prod/argocd-values.yaml (notifications.context.clusterName)
-domain: example.com                      # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.example.com         # → infra/values/aks-prod/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.example.com       # → infra/values/aks-prod/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.example.com           # → infra/values/aks-prod/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.example.com         # → infra/values/aks-prod/dot-ai-stack-values.yaml (dot-ai.ingress.host) — create if needed
-dotaiUiDomain: kubemcpui.example.com     # → infra/values/aks-prod/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host) — create if needed
-letsencryptEmail: admin@example.com      # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "10.0.0.0/8,168.63.129.16/32" # → infra/values/aks-prod/traefik-values.yaml (ports.*.trustedIPs) — VNet CIDR + Azure health probe
-cloudProvider: azure                     # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/eks-dev.yaml
+++ b/clusters/eks-dev.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: dev-eks                     # → infra/values/eks-dev/argocd-values.yaml (notifications.context.clusterName)
-domain: example.com                      # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.example.com         # → infra/values/eks-dev/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.example.com       # → infra/values/eks-dev/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.example.com           # → infra/values/eks-dev/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.example.com         # → infra/values/eks-dev/dot-ai-stack-values.yaml (dot-ai.ingress.host) — create if needed
-dotaiUiDomain: kubemcpui.example.com     # → infra/values/eks-dev/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host) — create if needed
-letsencryptEmail: admin@example.com      # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "10.0.0.0/8"                # → infra/values/eks-dev/traefik-values.yaml (ports.*.trustedIPs) — VPC CIDR
-cloudProvider: eks                       # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/eks-prod.yaml
+++ b/clusters/eks-prod.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: prod-eks                    # → infra/values/eks-prod/argocd-values.yaml (notifications.context.clusterName)
-domain: example.com                      # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.example.com         # → infra/values/eks-prod/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.example.com       # → infra/values/eks-prod/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.example.com           # → infra/values/eks-prod/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.example.com         # → infra/values/eks-prod/dot-ai-stack-values.yaml (dot-ai.ingress.host) — create if needed
-dotaiUiDomain: kubemcpui.example.com     # → infra/values/eks-prod/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host) — create if needed
-letsencryptEmail: admin@example.com      # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "10.0.0.0/8"                # → infra/values/eks-prod/traefik-values.yaml (ports.*.trustedIPs) — VPC CIDR
-cloudProvider: eks                       # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/eu.yaml
+++ b/clusters/eu.yaml
@@ -0,0 +1,10 @@
+clusterName: dev-fd-no-svg1
+domain: forteapps.net
+argocdDomain: argocd.127.0.0.1.nip.io
+grafanaDomain: grafana.forteapps.net
+keycloakDomain: id.forteapps.net
+dotaiDomain: kubemcp.forteapps.net
+dotaiUiDomain: kubemcpui.forteapps.net
+letsencryptEmail: danijels@gmail.com
+trustedIPs: "172.16.1.0/24"
+cloudProvider: upcloud
--- a/clusters/gke-dev.yaml
+++ b/clusters/gke-dev.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: dev-gke                     # → infra/values/gke-dev/argocd-values.yaml (notifications.context.clusterName)
-domain: example.com                      # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.example.com         # → infra/values/gke-dev/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.example.com       # → infra/values/gke-dev/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.example.com           # → infra/values/gke-dev/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.example.com         # → infra/values/gke-dev/dot-ai-stack-values.yaml (dot-ai.ingress.host) — create if needed
-dotaiUiDomain: kubemcpui.example.com     # → infra/values/gke-dev/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host) — create if needed
-letsencryptEmail: admin@example.com      # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "10.0.0.0/8,35.191.0.0/16,130.211.0.0/22" # → infra/values/gke-dev/traefik-values.yaml (ports.*.trustedIPs) — subnet + GCP health checks
-cloudProvider: gke                       # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/gke-prod.yaml
+++ b/clusters/gke-prod.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: prod-gke                    # → infra/values/gke-prod/argocd-values.yaml (notifications.context.clusterName)
-domain: example.com                      # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.example.com         # → infra/values/gke-prod/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.example.com       # → infra/values/gke-prod/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.example.com           # → infra/values/gke-prod/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.example.com         # → infra/values/gke-prod/dot-ai-stack-values.yaml (dot-ai.ingress.host) — create if needed
-dotaiUiDomain: kubemcpui.example.com     # → infra/values/gke-prod/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host) — create if needed
-letsencryptEmail: admin@example.com      # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "10.0.0.0/8,35.191.0.0/16,130.211.0.0/22" # → infra/values/gke-prod/traefik-values.yaml (ports.*.trustedIPs) — subnet + GCP health checks
-cloudProvider: gke                       # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/upc-dev.yaml
+++ b/clusters/upc-dev.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: dev-fd-no-svg1              # → infra/values/upc-dev/argocd-values.yaml (notifications.context.clusterName)
-domain: forteapps.net                    # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.127.0.0.1.nip.io   # → infra/values/upc-dev/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.forteapps.net     # → infra/values/upc-dev/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.forteapps.net         # → infra/values/upc-dev/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.forteapps.net       # → infra/values/upc-dev/dot-ai-stack-values.yaml (dot-ai.ingress.host)
-dotaiUiDomain: kubemcpui.forteapps.net   # → infra/values/upc-dev/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host)
-letsencryptEmail: danijels@gmail.com     # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "172.16.1.0/24"             # → infra/values/upc-dev/traefik-values.yaml (ports.*.trustedIPs)
-cloudProvider: upcloud                   # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/upc-prod.yaml
+++ b/clusters/upc-prod.yaml
@@ -1,12 +0,0 @@
-# Cluster config reference — values must match the corresponding overlay files.
-# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
-clusterName: prod-fd-no-svg1             # → infra/values/upc-prod/argocd-values.yaml (notifications.context.clusterName)
-domain: fortedigital.com                 # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
-argocdDomain: argocd.127.0.0.1.nip.io   # → infra/values/upc-prod/argocd-values.yaml (global.domain)
-grafanaDomain: grafana.fortedigital.com  # → infra/values/upc-prod/grafana-values.yaml (ingress.hosts)
-keycloakDomain: id.fortedigital.com      # → infra/values/upc-prod/keycloak-values.yaml (ingress.hostname)
-dotaiDomain: kubemcp.fortedigital.com    # → infra/values/upc-prod/dot-ai-stack-values.yaml (dot-ai.ingress.host)
-dotaiUiDomain: kubemcpui.fortedigital.com # → infra/values/upc-prod/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host)
-letsencryptEmail: danijel.simeunovic@fortedigital.com # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
-trustedIPs: "172.16.1.0/24"             # → infra/values/upc-prod/traefik-values.yaml (ports.*.trustedIPs)
-cloudProvider: upcloud                   # → determines overlay directory and cloud-specific LB/storage annotations
--- a/clusters/us.yaml
+++ b/clusters/us.yaml
@@ -0,0 +1,10 @@
+clusterName: dev-fd-us-east1
+domain: us.forteapps.net
+argocdDomain: argocd.us.forteapps.net
+grafanaDomain: grafana.us.forteapps.net
+keycloakDomain: id.us.forteapps.net
+dotaiDomain: kubemcp.us.forteapps.net
+dotaiUiDomain: kubemcpui.us.forteapps.net
+letsencryptEmail: danijels@gmail.com
+trustedIPs: "10.0.0.0/16"
+cloudProvider: tbd
--- a/devbox.json
+++ b/devbox.json
@@ -1,32 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
-  "packages": [
-    "kubectl@1.33.2",
-    "kubernetes-helm@3.18.4",
-    "k9s@0.50.7",
-    "kubeseal@0.30.0",
-    "argocd@2.14.11",
-    "kubecm@0.33.1",
-    "kubectl-tree@0.4.3",
-    "kind@0.29.0",
-    "kustomize@5.7.0",
-    "kyverno@1.14.3",
-    "syft@1.29.0",
-    "grype@0.92.2",
-    "traefik@3.6.7",
-    "claude-code@latest",
-    "go@latest",
-    "dotnet-sdk@latest",
-    "opentofu@1.11.6"
-  ],
-  "shell": {
-    "init_hook": [
-      "echo 'Welcome to devbox!' > /dev/null"
-    ],
-    "scripts": {
-      "test": [
-        "echo \"Error: no test specified\" && exit 1"
-      ]
-    }
-  }
-}
--- a/docs/DEVELOPER-GUIDE.md
+++ b/docs/DEVELOPER-GUIDE.md
@@ -9,7 +9,6 @@
 - [Updating an Existing Application](#updating-an-existing-application)
 - [Working with Secrets](#working-with-secrets)
 - [Enabling Authentication for Applications](#enabling-authentication-for-applications)
- [Adding a New Keycloak Client](#adding-a-new-keycloak-client)
 - [Troubleshooting](#troubleshooting)
 - [Best Practices](#best-practices)

@@ -90,21 +89,21 @@ If you do need cluster access, install:

 You'll need read/write access to these repositories:

-1. **launchpad** (Config repo)
+1. **sturdy-adventure** (Config repo)
   ```bash
-   git clone https://git.forteapps.net/Forte/launchpad.git
-   cd launchpad
+   git clone https://github.com/fortedigital/sturdy-adventure.git
+   cd sturdy-adventure
   ```

-2. **helm-prod-values** (Values repo)
+2. **helm-values** (Values repo)
   ```bash
-   git clone https://git.forteapps.net/Forte/helm-prod-values.git
-   cd helm-prod-values
+   git clone git@github.com:fortedigital/helm-values.git
+   cd helm-values
   ```

 3. **forte-helm** (Chart repo - read-only for most developers)
   ```bash
-   git clone https://git.forteapps.net/Forte/forte-helm.git
+   git clone https://github.com/snothub/forte-helm.git
   cd forte-helm
   ```

@@ -133,9 +132,9 @@ mkdir -p ~/dev/k8s
 cd ~/dev/k8s

 # Clone repositories
-git clone https://git.forteapps.net/Forte/launchpad.git launchpad
-git clone https://git.forteapps.net/Forte/helm-prod-values helm-prod-values
-git clone https://git.forteapps.net/Forte/forte-helm forte-helm
+git clone https://github.com/fortedigital/sturdy-adventure.git launchpad
+git clone git@github.com:fortedigital/helm-values.git helm-prod-values
+git clone https://github.com/snothub/forte-helm.git forte-helm

 # Your folder structure:
 # ~/dev/k8s/
@@ -175,13 +174,13 @@ npm run dev
 │  - GitHub Actions builds image                                  │
 │  - Pushes to container registry (GHCR, Docker Hub)              │
 │  - Tags with version (e.g., v2.0.4)                             │
-│  - Updates helm-prod-values repository with new tag                  │
+│  - Updates helm-values repository with new tag                  │
 └─────────────────────────────────────────────────────────────────┘
                            │
                            ▼
 ┌─────────────────────────────────────────────────────────────────┐
 │  Step 3: GitOps Sync (Automated)                                │
-│  - ArgoCD detects change in helm-prod-values                         │
+│  - ArgoCD detects change in helm-values                         │
 │  - Pulls updated configuration                                  │
 │  - Syncs to Kubernetes cluster                                  │
 │  - Sends Slack notification on success/failure                  │
@@ -201,8 +200,8 @@ Our setup uses three repositories:
 | Repository | Purpose | Who Edits | How Often |
 |------------|---------|-----------|-----------|
 | **forte-helm** | Helm chart templates (generic, reusable) | Platform engineers | ❌ Rarely |
-| **helm-prod-values** | Application configuration (image tag, env vars) | Developers / CI pipelines | ✅ Sometimes |
-| **launchpad** | ArgoCD Applications (what gets deployed) | Platform / DevOps engineers | ✅ Per new app |
+| **helm-values** | Application configuration (image tag, env vars) | Developers / CI pipelines | ✅ Sometimes |
+| **sturdy-adventure** | ArgoCD Applications (what gets deployed) | Platform / DevOps engineers | ✅ Per new app |

 ### Example: Deploying "myapp"

@@ -223,7 +222,7 @@ spec:
      value: {{ .Values.app.port }}
 ```

-#### Repository: `helm-prod-values` (Your App Config)
+#### Repository: `helm-values` (Your App Config)
 ```yaml
 # myapp/values.yaml
 # Your app's specific configuration
@@ -237,7 +236,7 @@ app:
    value: https://api.example.com
 ```

-#### Repository: `launchpad` (ArgoCD Application)
+#### Repository: `sturdy-adventure` (ArgoCD Application)
 ```yaml
 # apps/myapp.yaml
 # Tells ArgoCD to deploy your app
@@ -248,13 +247,13 @@ metadata:
  namespace: argocd
 spec:
  sources:
-  - repoURL: https://git.forteapps.net/Forte/forte-helm
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp
    helm:
      valueFiles:
      - $values/myapp/values.yaml

-  - repoURL: git@github.com:fortedigital/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    ref: values

  destination:
@@ -316,10 +315,10 @@ Ensure your app repository has:
             docker build -t ghcr.io/fortedigital/hello-world:${{ steps.version.outputs.VERSION }} .
             docker push ghcr.io/fortedigital/hello-world:${{ steps.version.outputs.VERSION }}

-         - name: Update helm-prod-values
+         - name: Update helm-values
           run: |
-             git clone git@github.com:fortedigital/helm-prod-values.git
-             cd helm-prod-values
+             git clone git@github.com:fortedigital/helm-values.git
+             cd helm-values
             mkdir -p hello-world
             cat > hello-world/values.yaml <<EOF
             app:
@@ -334,7 +333,7 @@ Ensure your app repository has:

 ### Step 2: Create Helm Values

-Create a folder in `helm-prod-values` repository:
+Create a folder in `helm-values` repository:

 ```bash
 cd ~/dev/k8s/helm-prod-values
@@ -387,7 +386,7 @@ git push

 ### Step 3: Create ArgoCD Application Manifest

-In the `launchpad` repository, create `apps/hello-world.yaml`:
+In the `sturdy-adventure` repository, create `apps/hello-world.yaml`:

 ```yaml
 apiVersion: argoproj.io/v1alpha1
@@ -412,7 +411,7 @@ spec:

  sources:
  # Source 1: Helm chart templates
-  - repoURL: https://git.forteapps.net/Forte/forte-helm
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp
    targetRevision: HEAD
    helm:
@@ -420,7 +419,7 @@ spec:
      - $values/hello-world/values.yaml

  # Source 2: Helm values
-  - repoURL: git@github.com:fortedigital/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    targetRevision: HEAD
    ref: values

@@ -528,7 +527,7 @@ git push origin main
 2. ✅ Builds new Docker image
 3. ✅ Tags with new version (e.g., `v20260316-143022`)
 4. ✅ Pushes to container registry
-5. ✅ Updates `helm-prod-values/myapp/values.yaml` with new tag
+5. ✅ Updates `helm-values/myapp/values.yaml` with new tag
 6. ✅ ArgoCD detects change
 7. ✅ Syncs new version to cluster
 8. ✅ Sends Slack notification
@@ -654,11 +653,21 @@ kubectl create secret generic myapp-credentials \

 #### Step 2: Seal the Secret

+Get the public certificate (one-time setup):
+
+```bash
+# Fetch public cert from cluster
+kubeseal --fetch-cert \
+  --controller-name=sealed-secrets-controller \
+  --controller-namespace=kube-system \
+  > pub-cert.pem
+```
+
 Seal your secret:

 ```bash
 kubeseal --format=yaml \
-  --namespace=myapp \
+  --cert=pub-cert.pem \
  < private/myapp-credentials.yaml \
  > secrets/myapp-credentials-sealed.yaml
 ```
@@ -673,7 +682,7 @@ git push

 #### Step 4: Reference Secret in Application

-Update your `helm-prod-values/myapp/values.yaml`:
+Update your `helm-values/myapp/values.yaml`:

 ```yaml
 app:
@@ -701,7 +710,7 @@ kubectl create secret generic myapp-credentials \

 # 2. Seal it
 kubeseal --format=yaml \
-  --namespace=myapp \
+  --cert=pub-cert.pem \
  < private/myapp-credentials.yaml \
  > secrets/myapp-credentials-sealed.yaml

@@ -781,7 +790,7 @@ Three authentication modes are supported:
 #### Step 1: Configure Helm Values

 ```yaml
-# In helm-prod-values/myapp/values.yaml
+# In helm-values/myapp/values.yaml
 auth:
  enabled: true
  type: token                    # Token mode (default)
@@ -903,7 +912,7 @@ rm private/myapp-auth-oidc.yaml
 #### Step 3: Configure Helm Values

 ```yaml
-# In helm-prod-values/myapp/values.yaml
+# In helm-values/myapp/values.yaml
 auth:
  enabled: true
  type: oidc                     # OIDC mode
@@ -952,46 +961,6 @@ User sees application (authenticated)

 ---

-### Accessing Authenticated User Information
-
-The auth sidecar handles all authentication before requests reach your application. Your app never sees unauthenticated traffic — the sidecar returns 401 or redirects to the IdP first.
-
-After successful authentication, the sidecar forwards the request to your application with user identity injected as HTTP headers:
-
-| Header | Description | Available in |
-|--------|-------------|-------------|
-| `X-Auth-User` | Username or display name | Token, OIDC, MCP |
-| `X-Auth-Email` | User email address | OIDC |
-| `X-Auth-Subject` | OIDC `sub` claim (stable user ID) | OIDC, MCP |
-| `X-Auth-Groups` | Comma-separated group memberships | OIDC (if scope includes `groups`) |
-| `X-Auth-Token` | The validated access token | All modes |
-
-**Your application reads these headers — no auth library needed:**
-
-```javascript
-// Express.js example
-app.get('/profile', (req, res) => {
-  const user = req.headers['x-auth-user'];
-  const email = req.headers['x-auth-email'];
-  res.json({ user, email });
-});
-```
-
-```python
-# Flask example
-@app.route('/profile')
-def profile():
-    user = request.headers.get('X-Auth-User')
-    email = request.headers.get('X-Auth-Email')
-    return jsonify(user=user, email=email)
-```
-
-**Why this is safe**: The Kyverno-generated NetworkPolicy restricts ingress to the sidecar port only. Traffic cannot bypass the sidecar to reach the application port directly, so the `X-Auth-*` headers can be trusted unconditionally.
-
-**Key principle**: Your application is zero-trust-unaware by design. It reads headers and renders UI. All authentication complexity lives in the sidecar and Kyverno policy.
-
---
-
 ### Authentication Configuration Reference

 #### Helm Values Schema
@@ -1056,7 +1025,7 @@ policies.forteapps.io/auth-upstream-url: "http://localhost:3000"
 #### Sidecar Configuration

 The auth sidecar container:
- **Image**: `ghcr.io/fortedigital/auth-sidecar:latest`
+- **Image**: `ghcr.io/snothub/stunning-memory:latest`
 - **Port**: 8080
 - **Resources**: 10m CPU / 32Mi memory (requests), 50m CPU / 64Mi memory (limits)
 - **Health checks**: `/healthz` endpoint
@@ -1079,7 +1048,7 @@ policies.forteapps.io/auth-image-version: "v1.2.3"
 #### Example 1: Internal API with Token Auth

 ```yaml
-# helm-prod-values/internal-api/values.yaml
+# helm-values/internal-api/values.yaml
 app:
  image:
    repository: ghcr.io/company/internal-api
@@ -1107,7 +1076,7 @@ curl -H "Authorization: Bearer d4f88f..." \
 #### Example 2: User-Facing App with OIDC

 ```yaml
-# helm-prod-values/web-app/values.yaml
+# helm-values/web-app/values.yaml
 app:
  image:
    repository: ghcr.io/company/web-app
@@ -1142,7 +1111,7 @@ kubectl create secret generic auth-oidc \
 #### Example 3: MCP Server with OAuth 2.0

 ```yaml
-# helm-prod-values/mcp-server/values.yaml
+# helm-values/mcp-server/values.yaml
 app:
  image:
    repository: ghcr.io/company/mcp-server
@@ -1166,7 +1135,7 @@ The MCP auth mode implements RFC 9728 (OAuth 2.0 Protected Resource Metadata) fo
 #### Example 4: Disabling Authentication

 ```yaml
-# helm-prod-values/public-api/values.yaml
+# helm-values/public-api/values.yaml
 auth:
  enabled: false                 # No authentication

@@ -1278,202 +1247,6 @@ kubectl logs -n myapp <pod-name> -c authn

 ---

-## Adding a New Keycloak Client
-
-There are two ways to add an OIDC client, depending on your use case:
-
-| Method | Best for | Who edits the infra repo? |
-|--------|----------|--------------------------|
-| **Self-service** (recommended) | New apps that deploy their own resources | App developer — no infra changes needed |
-| **Legacy (realm JSON)** | Existing clients already defined in forte-realm.json (e.g., Gitea) | Platform engineer |
-
-Both methods are served by the **Keycloak Client Registrar** CronJob, which runs every 2 minutes.
-
-### Self-Service OIDC Client Registration
-
-This is the recommended flow for new applications. Your app deploys a labeled config Secret in its own namespace; the platform handles everything else.
-
-#### How It Works
-
-1. You deploy a Secret with label `keycloak.forteapps.net/client-config: "true"` containing a `client.json` definition
-2. A **Kyverno ClusterPolicy** (`keycloak-client-config-cloner`) clones it to the `keycloak` namespace
-3. The **Client Registrar CronJob** picks it up within 2 minutes:
-   - Registers (or updates) the client in Keycloak
-   - Fetches the auto-generated client secret
-   - Creates a credential Secret in your app's namespace
-   - Annotates the config Secret with sync status
-
-#### Step 1: Create the Config Secret
-
-Deploy this Secret in your application's namespace (e.g., as part of your Helm chart or Kustomize overlay):
-
-```yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: keycloak-client-myapp
-  namespace: myapp
-  labels:
-    keycloak.forteapps.net/client-config: "true"
-stringData:
-  client.json: |
-    {
-      "clientId": "myapp",
-      "name": "My Application",
-      "redirectUris": ["https://myapp.forteapps.net/*"],
-      "webOrigins": ["https://myapp.forteapps.net"],
-      "defaultClientScopes": ["openid", "email", "profile"],
-      "protocolMappers": [],
-      "secret": {
-        "namespace": "myapp",
-        "name": "myapp-oidc-credentials",
-        "keys": { "clientId": "client-id", "clientSecret": "client-secret" }
-      }
-    }
-```
-
-**`client.json` fields**:
-
-| Field | Required | Description |
-|-------|----------|-------------|
-| `clientId` | Yes | Keycloak client ID |
-| `name` | Yes | Display name in Keycloak |
-| `redirectUris` | Yes | Allowed redirect URIs |
-| `webOrigins` | Yes | Allowed web origins (CORS) |
-| `defaultClientScopes` | No | Scopes (default: `["openid", "email", "profile"]`) |
-| `protocolMappers` | No | Custom claim mappers (default: `[]`) |
-| `secret.namespace` | No | Namespace for the credential Secret (default: source namespace) |
-| `secret.name` | No | Name of the credential Secret (default: `<clientId>-oidc-credentials`) |
-| `secret.keys.clientId` | No | Key name for client ID in credential Secret (default: `client-id`) |
-| `secret.keys.clientSecret` | No | Key name for client secret in credential Secret (default: `client-secret`) |
-
-#### Step 2: Reference the Credential Secret
-
-In your application's deployment config, reference the credential Secret that the registrar creates:
-
-```yaml
-env:
- name: OIDC_CLIENT_ID
-  valueFrom:
-    secretKeyRef:
-      name: myapp-oidc-credentials
-      key: client-id
- name: OIDC_CLIENT_SECRET
-  valueFrom:
-    secretKeyRef:
-      name: myapp-oidc-credentials
-      key: client-secret
-```
-
-#### Step 3: Deploy and Wait
-
-Commit and push your changes. The credential Secret will appear within 2 minutes:
-
-```bash
-# Watch for the credential Secret to be created
-kubectl get secret myapp-oidc-credentials -n myapp -w
-
-# Check registrar logs
-kubectl logs -n keycloak job/$(kubectl get jobs -n keycloak --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}')
-
-# Check sync status on the config Secret
-kubectl get secret keycloak-client-myapp -n keycloak -o jsonpath='{.metadata.annotations}'
-```
-
-#### Change Detection
-
-The registrar computes a SHA-256 hash of `client.json` and stores it as an annotation. On subsequent runs, it skips processing if:
- The hash hasn't changed, AND
- The credential Secret already exists in the target namespace
-
-To force a re-sync, update any field in `client.json` (e.g., add a trailing space to `name`).
-
-### Legacy Method: Realm JSON
-
-Existing clients (like Gitea) are defined directly in `forte-realm.json` inside `keycloak-values.yaml`. The registrar syncs their secrets via client attributes.
-
-#### Step 1: Add Client to Realm Config
-
-In `infra/values/base/keycloak-values.yaml`, add a new entry to the `clients` array in `forte-realm.json`:
-
-```json
-{
-  "clientId": "myapp",
-  "name": "My Application",
-  "enabled": true,
-  "protocol": "openid-connect",
-  "clientAuthenticatorType": "client-secret",
-  "standardFlowEnabled": true,
-  "directAccessGrantsEnabled": false,
-  "publicClient": false,
-  "redirectUris": ["https://myapp.forteapps.net/*"],
-  "webOrigins": ["https://myapp.forteapps.net"],
-  "defaultClientScopes": ["openid", "email", "profile"],
-  "attributes": {
-    "k8s.secret.sync": "true",
-    "k8s.secret.namespace": "myapp",
-    "k8s.secret.name": "myapp-oidc-credentials",
-    "k8s.secret.client-id-key": "key",
-    "k8s.secret.client-secret-key": "secret"
-  }
-}
-```
-
-**Important**:
- Do **NOT** include a `"secret"` field — Keycloak generates one automatically
- The `attributes` block tells the registrar where to create the K8s Secret
- Set `client-id-key` / `client-secret-key` to match what the consuming app expects (defaults: `client-id` / `client-secret`)
-
-#### Step 2: Reference the Secret in Your Application
-
-```yaml
-existingSecret: myapp-oidc-credentials
-```
-
-#### Step 3: Commit and Push
-
-```bash
-cd ~/dev/k8s/launchpad
-git add infra/values/base/keycloak-values.yaml
-git commit -m "Add myapp Keycloak client with auto-sync"
-git push
-```
-
-ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the new client within 2 minutes.
-
-#### Legacy Sync Attribute Reference
-
-| Attribute | Required | Default | Description |
-|-----------|----------|---------|-------------|
-| `k8s.secret.sync` | Yes | — | Set to `"true"` to enable syncing |
-| `k8s.secret.namespace` | Yes | — | Target K8s namespace for the secret |
-| `k8s.secret.name` | Yes | — | Name of the K8s Secret to create |
-| `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
-| `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |
-
-### Retrieving Secrets for External Deployments
-
-The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:
-
-```bash
-# View the central copy
-kubectl get secret gitea-oidc-credentials -n secrets -o yaml
-
-# Extract the client secret for use elsewhere
-kubectl get secret myapp-oidc-credentials -n secrets \
-  -o jsonpath='{.data.client-secret}' | base64 -d
-```
-
-### Registrar Behavior Notes
-
- The registrar runs as a CronJob every 2 minutes (`concurrencyPolicy: Forbid`)
- If the target namespace doesn't exist, the target write is skipped with a warning (the central copy still happens)
- A central copy is **always** written to the `secrets` namespace for every synced client
- The registrar uses the `keycloak-credentials` secret for admin authentication
- Created secrets have the label `app.kubernetes.io/managed-by: keycloak-client-registrar`
-
---
-
 ## Troubleshooting

 ### Application Not Deploying
@@ -1530,7 +1303,7 @@ kubectl exec -n myapp <pod-name> -- env
 # Check if secrets exist
 kubectl get secrets -n myapp

-# Increase resources in helm-prod-values
+# Increase resources in helm-values
 vim ~/dev/k8s/helm-prod-values/myapp/values.yaml
 ```

@@ -1679,7 +1452,7 @@ If you're stuck:
 ### Configuration Management

 ✅ **DO**:
- Keep configuration in `helm-prod-values` repository
+- Keep configuration in `helm-values` repository
 - Use environment variables for config
 - Document what each value does
 - Use reasonable resource limits
@@ -1806,4 +1579,4 @@ Now that you understand the basics:
 - Docs: [Full documentation index](README.md)
 - Help: Contact platform team

-**Last Updated**: 2026-04-16
+**Last Updated**: 2026-03-16
--- a/docs/GITOPS-ARCHITECTURE.md
+++ b/docs/GITOPS-ARCHITECTURE.md
@@ -12,16 +12,16 @@

 ## Overview

-This Kubernetes cluster uses a **GitOps approach** powered by **ArgoCD**, where Git repositories serve as the single source of truth for both infrastructure and application deployments. The cluster setup is **cloud-agnostic**, with ready-to-use configurations for **UpCloud**, **AWS EKS**, **Azure AKS**, and **GCP GKE**.
+This Kubernetes cluster uses a **GitOps approach** powered by **ArgoCD**, where Git repositories serve as the single source of truth for both infrastructure and application deployments. The cluster is running on **UpCloud Managed Kubernetes** but is designed to be cloud-agnostic.

 ### Key Characteristics
 - **Environment**: Production (internal use only)
- **Cluster Type**: Multi-cloud, multi-cluster via Kustomize overlays (UpCloud, AWS, Azure, GCP)
+- **Cluster Type**: Single cluster, single environment
 - **GitOps Tool**: ArgoCD
 - **Deployment Pattern**: App-of-Apps
 - **Secret Management**: Sealed Secrets (kubeseal)
 - **Ingress**: Traefik with Let's Encrypt TLS
- **Monitoring**: Prometheus + Grafana + Loki + Tempo + Fluent-Bit
+- **Monitoring**: Prometheus + Grafana + Loki + Fluent-Bit
 - **Policy Engine**: Kyverno
 - **Notifications**: Slack integration for sync status

@@ -47,14 +47,14 @@ This Kubernetes cluster uses a **GitOps approach** powered by **ArgoCD**, where
         │                            │                          │
         │                            │                          │
         └────────► Update image tag ─┴──────────────────────────┘
-                    in helm-prod-values                               │
+                    in helm-values                               │
                                                                 │
                                                                 ▼
                                           ┌────────────────────────────────┐
                                           │   Config Repository            │
                                           │   (ArgoCD Applications)        │
-                                           │   git.forteapps.net/Forte/     │
-                                           │   launchpad                    │
+                                           │   github.com/snothub/          │
+                                           │   sturdy-adventure             │
                                           └────────────────────────────────┘
                                                        │
                                                        │
@@ -62,8 +62,8 @@ This Kubernetes cluster uses a **GitOps approach** powered by **ArgoCD**, where
                                                        │
                                                        ▼
                                           ┌────────────────────────────────┐
-                                           │   Kubernetes Clusters          │
-                                           │   (UpCloud, AWS, Azure, GCP)    │
+                                           │   Kubernetes Cluster           │
+                                           │   (UpCloud Managed)            │
                                           │                                │
                                           │  ┌──────────────────────────┐  │
                                           │  │    ArgoCD                │  │
@@ -83,7 +83,6 @@ This Kubernetes cluster uses a **GitOps approach** powered by **ArgoCD**, where
                                           │  │  - Prometheus            │  │
                                           │  │  - Grafana               │  │
                                           │  │  - Loki                  │  │
-                                           │  │  - Tempo                 │  │
                                           │  │  - Fluent-Bit            │  │
                                           │  └──────────────────────────┘  │
                                           │                                │
@@ -109,85 +108,87 @@ This Kubernetes cluster uses a **GitOps approach** powered by **ArgoCD**, where
 ## Repository Structure

 ### 1. **Config Repository** (Current Repo)
-**Repository**: `https://git.forteapps.net/Forte/launchpad`
+**Repository**: `https://github.com/fortedigital/sturdy-adventure.git`
 **Purpose**: GitOps configuration - ArgoCD Applications and cluster resources
 **Location**: `C:\dev\k8s\launchpad`

 ```
-launchpad/
+sturdy-adventure/
 ├── bootstrap.sh                      # Cluster initialization script
-├── _app-of-apps-upc-dev.yaml        # Root ArgoCD Application (upc-dev cluster)
-├── _app-of-apps-upc-prod.yaml       # Root ArgoCD Application (upc-prod cluster)
+├── _app-of-apps.yaml                 # Root ArgoCD Application (App-of-Apps pattern)
 │
-├── infra/                            # Infrastructure ArgoCD Applications (Kustomize)
-│   ├── base/                         # Base Application manifests (one dir per component)
-│   │   ├── kustomization.yaml        # Aggregates all component subdirectories
-│   │   ├── traefik-application/
-│   │   │   ├── kustomization.yaml
-│   │   │   └── traefik-application.yaml
-│   │   ├── keycloak/
-│   │   │   ├── kustomization.yaml
-│   │   │   └── keycloak.yaml
-│   │   ├── grafana/
-│   │   ├── prometheus/
-│   │   ├── ...                       # Each component in its own subdirectory
-│   │   └── secrets/
-│   ├── overlays/                     # Per-cluster Kustomize overrides
-│   │   ├── upc-dev/                  # UpCloud Dev — includes all (resources: ../../base)
-│   │   ├── upc-prod/                # UpCloud Prod — all + patches
-│   │   ├── aks-dev/                 # Azure AKS Dev — selective components
-│   │   ├── aks-prod/               # Azure AKS Prod
-│   │   ├── eks-dev/                  # AWS EKS Dev
-│   │   ├── eks-prod/                # AWS EKS Prod
-│   │   ├── gke-dev/                 # GCP GKE Dev
-│   │   └── gke-prod/               # GCP GKE Prod
-│   ├── dashboards/                   # Grafana dashboard ConfigMaps
+├── infra/                            # Infrastructure ArgoCD Applications
+│   ├── enterprise-apps.yaml          # Parent app managing all apps in apps/
+│   ├── cluster-resources-application.yaml
+│   ├── traefik-application.yaml
+│   ├── cert-manager-application.yaml
+│   ├── kyverno.yaml
+│   ├── kyverno-policies.yaml
+│   ├── prometheus.yaml
+│   ├── grafana.yaml
+│   ├── loki.yaml
+│   ├── fluent-bit.yaml
+│   ├── trivy.yaml
+│   ├── sealedsecrets.yaml
+│   ├── secrets.yaml
 │   └── values/                       # Helm value overrides for infra
-│       ├── base/                     # Cloud-agnostic shared values
-│       ├── upc-{dev,prod}/           # UpCloud: storage class, LB, pricing
-│       ├── aws-{dev,prod}/           # AWS: gp3, NLB, CUR pricing
-│       ├── aks-{dev,prod}/         # Azure: managed-csi-premium, Standard LB
-│       └── gcp-{dev,prod}/           # GCP: premium-rwo, L4 LB
+│       ├── argocd-values.yaml
+│       ├── prometheus-values.yaml
+│       ├── grafana-values.yaml
+│       ├── loki-values.yaml
+│       └── fluent-bit-values.yaml
 │
-├── apps/                             # Business Application ArgoCD manifests (Kustomize)
-│   ├── base/                         # One subdirectory per app
-│   │   ├── kustomization.yaml
-│   │   ├── musicman/
-│   │   ├── mcp10x/
-│   │   ├── dot-ai-stack/
-│   │   ├── ts-mcp/
-│   │   └── argo-mcp/
-│   └── overlays/
-│       ├── upc-dev/                  # All apps (resources: ../../base)
-│       ├── upc-prod/                # All apps + patches
-│       └── aks-dev/                 # Selective apps only
+├── apps/                             # Business Application ArgoCD manifests
+│   ├── mcp10x.yaml                   # MCP 10X application
+│   ├── musicman.yaml                 # Music Man application
+│   ├── dot-ai-stack.yaml             # Dot AI Stack
+│   └── argo-mcp.yaml                 # ArgoCD MCP server
 │
 ├── cluster-resources/                # Cluster-wide Kubernetes resources
-│   ├── ...
+│   ├── cert-manager-namespace.yaml
+│   ├── secrets-namespace.yaml
+│   ├── letsencrypt-issuer.yaml       # Let's Encrypt ClusterIssuer
+│   ├── kyverno-config.yaml
+│   ├── argocd-notifications-secret-sealed.yaml
+│   ├── snothub-repo-credentials-sealed.yaml
+│   ├── forte10x-repo-credentials-sealed.yaml
+│   ├── mcp10x-repo-credentials-sealed.yaml
 │   └── policies/                     # Kyverno policies
+│       ├── deployment-verifier.yaml
+│       ├── label-checker.yaml
+│       ├── bare-pod-cleaner.yaml
+│       ├── replicaset-cleaner.yaml
+│       ├── default-ns-blocker.yaml
+│       ├── secret-cloner.yaml
+│       └── auth-sidecar-injector.yaml
 │
-├── secrets/                          # Application secrets (sealed, per-cluster)
-│   └── upc-dev/                      # Secrets for upc-dev cluster
+├── secrets/                          # Application secrets (sealed)
+│   ├── argocd-mcp-credentials.yaml
+│   ├── dot-ai-secrets.yaml
+│   ├── mcp10x-credentials-sealed.yaml
+│   └── musicman-credentials.yaml
 │
 ├── private/                          # Local-only files (NOT in Git)
+│   ├── *.yaml                        # Unsealed secrets
+│   └── *.sh                          # Helper scripts
 │
 └── docs/                             # Documentation
+    ├── GITOPS-ARCHITECTURE.md        # This file
+    ├── DEVELOPER-GUIDE.md
+    ├── OPERATIONS-RUNBOOK.md
+    └── REFERENCE.md
 ```

 **Key Points**:
- `_app-of-apps-upc-dev.yaml` and `_app-of-apps-upc-prod.yaml` are the per-cluster root Applications
- Each component in `base/` has its own subdirectory with a `kustomization.yaml`
- Overlays can include **all** components (`resources: [../../base]`) or **cherry-pick** specific ones (`resources: [../../base/grafana, ../../base/prometheus]`)
- Kustomize overlays in `infra/overlays/` render base Applications with per-cluster patches
- Helm values are split: `values/base/` (shared) + `values/upc-dev/` or `values/upc-prod/` (cluster-specific)
- `apps/` follows the same base/overlays pattern for business applications
+- `_app-of-apps.yaml` is the root Application that ArgoCD monitors
+- `infra/enterprise-apps.yaml` auto-discovers all apps in `apps/` folder
 - Changes pushed to this repo trigger automatic syncs in ArgoCD
 - `private/` folder contains local-only files (Git-ignored)

 ---

 ### 2. **Helm Charts Repository**
-**Repository**: `https://git.forteapps.net/Forte/forte-helm`
+**Repository**: `https://github.com/snothub/forte-helm`
 **Purpose**: Reusable Helm chart templates for Forte applications
 **Location**: `C:\dev\k8s\forte-helm`

@@ -221,7 +222,7 @@ forte-helm/
 ---

 ### 3. **Helm Values Repository**
-**Repository**: `git@github.com:fortedigital/helm-prod-values.git`
+**Repository**: `git@github.com:fortedigital/helm-values.git`
 **Purpose**: Environment-specific configuration for each application
 **Location**: `C:\dev\k8s\helm-prod-values`

@@ -231,6 +232,8 @@ helm-prod-values/
 │   └── values.yaml                   # MCP 10X configuration
 ├── musicman/
 │   └── values.yaml                   # Music Man configuration
+├── mcpcoder/
+│   └── values.yaml                   # MCP Coder configuration
 └── argocd-mcp/
    └── values.yaml                   # ArgoCD MCP configuration
 ```
@@ -280,7 +283,7 @@ app-repository/
 2. Build Docker image
 3. Tag with version (e.g., `v2.0.4`)
 4. Push to container registry (GHCR, Docker Hub, etc.)
-5. Update image tag in `helm-prod-values` repository
+5. Update image tag in `helm-values` repository
 6. ArgoCD detects change and syncs automatically

 ---
@@ -290,7 +293,7 @@ app-repository/
 ### The App-of-Apps Pattern

 ```
-_app-of-apps-{cluster}.yaml (Root, per cluster — e.g. upc-dev, eks-prod, gke-dev)
+_app-of-apps.yaml (Root)
    │
    ├── infrastructure-apps (manages infra/)
    │   ├── cluster-resources-application
@@ -299,7 +302,6 @@ _app-of-apps-{cluster}.yaml (Root, per cluster — e.g. upc-dev, eks-prod, gke-d
    │   ├── kyverno
    │   ├── prometheus
    │   ├── grafana
-    │   ├── tempo
    │   └── ... (other infra apps)
    │
    └── enterprise-apps (manages apps/)
@@ -310,10 +312,10 @@ _app-of-apps-{cluster}.yaml (Root, per cluster — e.g. upc-dev, eks-prod, gke-d
 ```

 **How It Works**:
-1. Bootstrap script installs ArgoCD and applies `_app-of-apps-upc-dev.yaml` (or `upc-prod`)
-2. ArgoCD creates the root Application which monitors the appropriate `infra/overlays/` folder
-3. Kustomize renders base Applications with cluster-specific patches
-4. `enterprise-apps` Application monitors the cluster's `apps/overlays/` folder
+1. Bootstrap script installs ArgoCD and applies `_app-of-apps.yaml`
+2. ArgoCD creates the root Application which monitors `infra/` folder
+3. Each YAML in `infra/` becomes a child Application
+4. `enterprise-apps.yaml` monitors `apps/` folder and auto-discovers applications
 5. ArgoCD continuously syncs (every 60s) and auto-heals drift

 ### Sync Waves & Ordering
@@ -341,13 +343,13 @@ Applications like `mcp10x` and `musicman` use multiple sources:
 ```yaml
 spec:
  sources:
-  - repoURL: https://git.forteapps.net/Forte/forte-helm
+  - repoURL: https://github.com/snothub/forte-helm
    path: forteapp                     # Helm chart templates
    helm:
      valueFiles:
      - $values/mcp10x/values.yaml     # Reference to second source

-  - repoURL: git@github.com:fortedigital/helm-prod-values.git
+  - repoURL: git@github.com:fortedigital/helm-values.git
    targetRevision: HEAD
    ref: values                        # Named reference
 ```
@@ -358,57 +360,6 @@ spec:
 - Easy to update all apps by changing the chart
 - Environment-specific values isolated in separate repo

-### Multi-Cluster Pattern
-
-Kustomize overlays enable deploying the same Applications across clusters with different configurations.
-
-Each component in `infra/base/` and `apps/base/` lives in its own subdirectory. Overlays define **which components to include** and optionally **patch** them:
-
-```yaml
-# Option 1: Include ALL components (full cluster)
-# infra/overlays/upc-dev/kustomization.yaml
-resources:
- ../../base                    # Pulls in every component subdirectory
-
-# Option 2: Cherry-pick specific components (lightweight cluster)
-# infra/overlays/aks-dev/kustomization.yaml
-resources:
- ../../base/traefik-application
- ../../base/grafana
- ../../base/prometheus
- ../../base/loki
-# Only listed components are deployed — others are excluded
-```
-
-Per-cluster patches swap Helm value file paths:
-
-```yaml
-# infra/overlays/upc-prod/kustomization.yaml
-patches:
- target:
-    kind: Application
-    name: traefik
-  patch: |
-    - op: replace
-      path: /spec/sources/0/helm/valueFiles/1
-      value: $values/infra/values/upc-prod/traefik-values.yaml
-```
-
-Cloud-specific values (storage classes, load balancer annotations, cost model) are isolated in per-cluster value files. Base values are fully cloud-agnostic:
-
-| Cloud | Storage Class | Load Balancer | OpenCost Provider |
-|-------|--------------|---------------|-------------------|
-| **UpCloud** | `upcloud-block-storage-maxiops` | UpCloud LB (ProxyProtocol v2) | Custom pricing |
-| **AWS EKS** | `gp3` (EBS CSI) | NLB (ProxyProtocol v2) | AWS CUR |
-| **Azure AKS** | `managed-csi-premium` | Standard LB (`externalTrafficPolicy: Local`) | Azure Billing API |
-| **GCP GKE** | `premium-rwo` (PD CSI) | L4 passthrough NLB | GCP Cloud Billing |
-
-**Benefits**:
- Single source of truth for Application definitions
- Cluster-specific values isolated per overlay
- Easy to add new clusters by creating a new overlay
- Base values shared across all clusters reduce duplication
-
 ---

 ## CI/CD Pipeline
@@ -438,8 +389,8 @@ jobs:

      - name: Update Helm values
        run: |
-          git clone git@github.com:fortedigital/helm-prod-values.git
-          cd helm-prod-values/app
+          git clone git@github.com:fortedigital/helm-values.git
+          cd helm-values/app
          sed -i "s/tag: .*/tag: $VERSION/" values.yaml
          git commit -am "Update app to $VERSION"
          git push
@@ -451,12 +402,12 @@ jobs:

 1. **Config Repo Change**:
   - Developer updates `apps/myapp.yaml`
-   - Pushes to `launchpad` repo
+   - Pushes to `sturdy-adventure` repo
   - ArgoCD detects change (60s reconciliation)
   - Syncs application to cluster

 2. **Helm Values Change**:
-   - CI/CD updates `helm-prod-values/myapp/values.yaml`
+   - CI/CD updates `helm-values/myapp/values.yaml`
   - ArgoCD detects change
   - Pulls new Helm chart with updated values
   - Applies to cluster
@@ -538,6 +489,7 @@ git commit -m "Add app credentials"
 **Private Repository Credentials** stored as SealedSecrets:

 ```yaml
+# cluster-resources/snothub-repo-credentials-sealed.yaml
 # cluster-resources/forte10x-repo-credentials-sealed.yaml
 ```

@@ -576,9 +528,8 @@ annotations:
 1. **Prometheus**: Metrics collection and storage
 2. **Grafana**: Metrics visualization and dashboards
 3. **Loki**: Log aggregation
-4. **Tempo**: Distributed tracing (OTLP)
-5. **Fluent-Bit**: Log shipping from pods to Loki
-6. **Trivy**: Container vulnerability scanning
+4. **Fluent-Bit**: Log shipping from pods to Loki
+5. **Trivy**: Container vulnerability scanning

 ### Slack Notifications

@@ -607,7 +558,7 @@ Notifications include:

 **Rebuild Process**:
 1. Provision new Kubernetes cluster
-2. Clone `launchpad` repository
+2. Clone `sturdy-adventure` repository
 3. Run `./bootstrap.sh`
 4. ArgoCD installs and syncs all applications
 5. Manually recreate unsealed secrets and seal them
@@ -663,7 +614,7 @@ Notifications include:
 ✅ **DO**:
 - Follow the `forteapp` chart pattern
 - Use semantic versioning for image tags
- Update helm-prod-values via CI/CD
+- Update helm-values via CI/CD
 - Test locally with Docker Compose
 - Document environment variables

@@ -684,6 +635,6 @@ Notifications include:

 ---

-**Last Updated**: 2026-04-22
+**Last Updated**: 2026-03-16
 **Maintained By**: Platform Team
 **Questions?**: Contact #platform-support on Slack
--- a/docs/OPERATIONS-RUNBOOK.md
+++ b/docs/OPERATIONS-RUNBOOK.md
@@ -37,7 +37,7 @@ Bootstrap a new cluster from scratch:

 #### Prerequisites

-1. **Kubernetes cluster running** (UpCloud, AWS EKS, Azure AKS, GCP GKE, or any K8s cluster)
+1. **Kubernetes cluster running** (UpCloud or any K8s cluster)
 2. **kubectl configured** with admin access
 3. **Repositories cloned** locally

@@ -51,16 +51,14 @@ kubectl get nodes

 ```bash
 # 1. Clone config repository
-git clone https://git.forteapps.net/Forte/launchpad
-cd launchpad
+git clone https://github.com/fortedigital/sturdy-adventure.git
+cd sturdy-adventure

-# 2. Run bootstrap script with cluster target
-# Available clusters: upc-dev, upc-prod, eks-dev, eks-prod,
-#                     aks-dev, aks-prod, gke-dev, gke-prod
-./bootstrap.sh upc-dev
+# 2. Set cluster name (optional)
+export CLUSTER_NAME="prod-cluster-01"

-# Cluster config is loaded from clusters/<cluster>.yaml
-# (cloudProvider, trustedIPs, domain, etc.)
+# 3. Run bootstrap script
+./bootstrap.sh
 ```

 **What Happens:**
@@ -87,8 +85,7 @@ kubectl get applications -n argocd

 1. **Configure DNS** for ingress domains:
   - `argocd.127.0.0.1.nip.io` (local dev)
-   - `*.forteapps.net` (dev)
-   - `*.fortedigital.com` (production)
+   - `*.forteapps.net` (production)

 2. **Verify Let's Encrypt certificates**:
   ```bash
@@ -110,7 +107,7 @@ kubectl get applications -n argocd

 ### ArgoCD Repository Access Setup

-ArgoCD needs SSH access to private Git repositories to pull manifests and Helm values. This section covers setting up deploy keys for Gitea repositories.
+ArgoCD needs SSH access to private Git repositories to pull manifests and Helm values. This section covers setting up deploy keys for GitHub repositories.

 #### Why Deploy Keys?

@@ -122,7 +119,7 @@ ArgoCD needs SSH access to private Git repositories to pull manifests and Helm v
 #### Prerequisites

 - kubectl access to the cluster
- Write access to the Gitea repository
+- Write access to the GitHub repository
 - ArgoCD installed and running

 #### Setup Procedure
@@ -133,25 +130,25 @@ Generate a dedicated SSH key for ArgoCD without a passphrase (required for autom

 ```bash
 # Generate ED25519 key (recommended - smaller and more secure)
-ssh-keygen -t ed25519 -C "argocd-deploy-key-launchpad" -f argocd-deploy-key -N ""
+ssh-keygen -t ed25519 -C "argocd-deploy-key-sturdy-adventure" -f argocd-deploy-key -N ""

 # Or RSA key if ED25519 is not supported
-ssh-keygen -t rsa -b 4096 -C "argocd-deploy-key-launchpad" -f argocd-deploy-key -N ""
+ssh-keygen -t rsa -b 4096 -C "argocd-deploy-key-sturdy-adventure" -f argocd-deploy-key -N ""
 ```

 This creates two files:
 - `argocd-deploy-key` - Private key (keep secret)
- `argocd-deploy-key.pub` - Public key (add to Gitea)
+- `argocd-deploy-key.pub` - Public key (add to GitHub)

-**Step 2: Add Public Key to Gitea**
+**Step 2: Add Public Key to GitHub**

 1. Copy the public key:
   ```bash
   cat argocd-deploy-key.pub
   ```

-2. Go to Gitea repository settings:
-   - Navigate to: `https://git.forteapps.net/Forte/launchpad/settings/keys`
+2. Go to GitHub repository settings:
+   - Navigate to: `https://github.com/fortedigital/sturdy-adventure/settings/keys`
   - Or: Repository → Settings → Deploy keys

 3. Click **"Add deploy key"**
@@ -160,45 +157,90 @@ This creates two files:
   - ☐ Allow write access (leave unchecked - read-only is sufficient)
   - Click **"Add key"**

-4. Repeat for the `helm-prod-values` repository if it's private:
+4. Repeat for the `helm-values` repository if it's private:
   ```bash
-   # Generate separate key for helm-prod-values repo
-   ssh-keygen -t ed25519 -C "argocd-deploy-key-helm-prod-values" -f argocd-helm-prod-values-key -N ""
+   # Generate separate key for helm-values repo
+   ssh-keygen -t ed25519 -C "argocd-deploy-key-helm-values" -f argocd-helm-values-key -N ""

-   # Add to: https://git.forteapps.net/Forte/helm-prod-values/settings/keys
+   # Add to: https://github.com/fortedigital/helm-values/settings/keys
   ```

 **Step 3: Create Kubernetes Secret**

 Add the private key to ArgoCD as a repository secret:

-Save the following file in private/ (gitignored) folder as secret.yaml
 ```bash
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: forte-helm-repo
-    namespace: argocd
-    labels:
-      argocd.argoproj.io/secret-type: repository
-  stringData:
-    type: git
-    url: ssh://git@git.forteapps.net:2222/Forte/forte-helm.git
-    sshPrivateKey: |
-      <paste your private key here>
-    project: default
-```
-Seal the secret using `kubeseal` command 
-```bash
-kubeseal --format=yaml \
+# Create secret for sturdy-adventure repository
+kubectl create secret generic repo-sturdy-adventure \
+  --from-file=sshPrivateKey=argocd-deploy-key \
  --namespace=argocd \
-  < private/secret.yaml \
-  > secrets/forte-helm-repo-secret-sealed.yaml
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Label it for ArgoCD to recognize
+kubectl label secret repo-sturdy-adventure \
+  -n argocd \
+  argocd.argoproj.io/secret-type=repository
+
+# Add repository annotations
+kubectl annotate secret repo-sturdy-adventure \
+  -n argocd \
+  managed-by=argocd.argoproj.io
+```
+
+Alternatively, create a complete repository secret with all metadata:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Secret
+metadata:
+  name: repo-sturdy-adventure
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+  annotations:
+    managed-by: argocd.argoproj.io
+type: Opaque
+stringData:
+  type: git
+  url: git@github.com:fortedigital/sturdy-adventure.git
+  sshPrivateKey: |
+$(cat argocd-deploy-key | sed 's/^/    /')
+EOF
 ```

 **Step 4: Register Repository in ArgoCD**

-Check in secrets/forte-helm-repo-secret-sealed.yaml and let Argo sync and create the secret.
+Add the repository to ArgoCD's configuration:
+
+```bash
+# Via kubectl (recommended for GitOps)
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Secret
+metadata:
+  name: repo-sturdy-adventure
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+type: Opaque
+stringData:
+  type: git
+  url: git@github.com:fortedigital/sturdy-adventure.git
+  sshPrivateKey: |
+$(cat argocd-deploy-key | sed 's/^/    /')
+  insecure: "false"
+  enableLfs: "false"
+EOF
+
+# Or via ArgoCD UI
+# 1. Open ArgoCD UI: kubectl port-forward svc/argocd-server -n argocd 8080:443
+# 2. Navigate to: Settings → Repositories → Connect Repo
+# 3. Connection Method: Via SSH
+# 4. Repository URL: git@github.com:fortedigital/sturdy-adventure.git
+# 5. SSH private key: Paste private key content
+# 6. Click "Connect"
+```

 **Step 5: Verify Repository Access**

@@ -210,7 +252,7 @@ kubectl get secrets -n argocd -l argocd.argoproj.io/secret-type=repository
 # Settings → Repositories → Should show "Successful" status

 # Test by creating an application
-kubectl apply -f _app-of-apps-upc-dev.yaml   # or _app-of-apps-upc-prod.yaml
+kubectl apply -f _app-of-apps.yaml

 # Check application sync status
 kubectl get applications -n argocd
@@ -230,7 +272,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: main
    path: cluster-resources
  destination:
@@ -273,15 +315,15 @@ rm /tmp/test-repo-access.yaml
   # Generate new key
   ssh-keygen -t ed25519 -C "argocd-deploy-key-$(date +%Y%m)" -f argocd-new-key -N ""

-   # Add new public key to Gitea (keep old key for now)
+   # Add new public key to GitHub (keep old key for now)

   # Update Kubernetes secret
-   kubectl create secret generic repo-launchpad \
+   kubectl create secret generic repo-sturdy-adventure \
     --from-file=sshPrivateKey=argocd-new-key \
     --namespace=argocd \
     --dry-run=client -o yaml | kubectl apply -f -

-   # Test access, then remove old deploy key from Gitea
+   # Test access, then remove old deploy key from GitHub

   # Clean up
   shred -u argocd-new-key
@@ -292,8 +334,8 @@ rm /tmp/test-repo-access.yaml
   # List all repository secrets
   kubectl get secrets -n argocd -l argocd.argoproj.io/secret-type=repository

-   # Review deploy keys in Gitea
-   # Visit: https://git.forteapps.net/Forte/launchpad/settings/keys
+   # Review deploy keys in GitHub
+   # Visit: https://github.com/fortedigital/sturdy-adventure/settings/keys
   ```

 4. **Use Different Keys per Repository**
@@ -307,27 +349,27 @@ rm /tmp/test-repo-access.yaml

 ```bash
 # Check if secret exists
-kubectl get secret repo-launchpad -n argocd
+kubectl get secret repo-sturdy-adventure -n argocd

 # Verify secret has correct label
-kubectl get secret repo-launchpad -n argocd -o yaml | grep argocd.argoproj.io/secret-type
+kubectl get secret repo-sturdy-adventure -n argocd -o yaml | grep argocd.argoproj.io/secret-type

 # Check ArgoCD application controller logs
 kubectl logs -n argocd deployment/argocd-application-controller | grep -i "permission denied"

-# Verify deploy key is added to Gitea
-# Visit: https://git.forteapps.net/Forte/launchpad/settings/keys
+# Verify deploy key is added to GitHub
+# Visit: https://github.com/fortedigital/sturdy-adventure/settings/keys
 ```

 **Issue: "Host key verification failed"**

 ```bash
-# Add Gitea to known_hosts
+# Add GitHub to known_hosts
 kubectl exec -n argocd deployment/argocd-repo-server -- \
-  ssh-keyscan git.forteapps.net >> ~/.ssh/known_hosts
+  ssh-keyscan github.com >> ~/.ssh/known_hosts

 # Or disable strict host key checking (less secure)
-kubectl patch secret repo-launchpad -n argocd \
+kubectl patch secret repo-sturdy-adventure -n argocd \
  --type merge \
  -p '{"stringData":{"insecure":"true"}}'
 ```
@@ -339,7 +381,7 @@ kubectl patch secret repo-launchpad -n argocd \
 kubectl logs -n argocd deployment/argocd-repo-server

 # Refresh repository connection
-kubectl delete secret repo-launchpad -n argocd
+kubectl delete secret repo-sturdy-adventure -n argocd
 # Recreate secret (see Step 3 above)

 # Restart ArgoCD components
@@ -349,34 +391,34 @@ kubectl rollout restart deployment argocd-application-controller -n argocd

 #### Multiple Repository Setup

-For the three-repository pattern (launchpad, forte-helm, helm-prod-values):
+For the three-repository pattern (sturdy-adventure, forte-helm, helm-values):

 ```bash
-# 1. launchpad (main config repo)
-ssh-keygen -t ed25519 -C "argocd-launchpad" -f key-sturdy -N ""
-# Add key-sturdy.pub to: https://git.forteapps.net/Forte/launchpad/settings/keys
+# 1. sturdy-adventure (main config repo)
+ssh-keygen -t ed25519 -C "argocd-sturdy-adventure" -f key-sturdy -N ""
+# Add key-sturdy.pub to: https://github.com/fortedigital/sturdy-adventure/settings/keys

-# 2. helm-prod-values (private values repo)
-ssh-keygen -t ed25519 -C "argocd-helm-prod-values" -f key-helm-prod-values -N ""
-# Add key-helm-prod-values.pub to: https://git.forteapps.net/Forte/helm-prod-values/settings/keys
+# 2. helm-values (private values repo)
+ssh-keygen -t ed25519 -C "argocd-helm-values" -f key-helm-values -N ""
+# Add key-helm-values.pub to: https://github.com/fortedigital/helm-values/settings/keys

-# 3. forte-helm (private helm charts repo)
+# 3. forte-helm is public - no key needed (use HTTPS)

 # Create secrets
-kubectl create secret generic repo-launchpad \
+kubectl create secret generic repo-sturdy-adventure \
  --from-file=sshPrivateKey=key-sturdy \
  --namespace=argocd --dry-run=client -o yaml | \
  kubectl label --local -f - argocd.argoproj.io/secret-type=repository --dry-run=client -o yaml | \
  kubectl apply -f -

-kubectl create secret generic repo-helm-prod-values \
-  --from-file=sshPrivateKey=key-helm-prod-values \
+kubectl create secret generic repo-helm-values \
+  --from-file=sshPrivateKey=key-helm-values \
  --namespace=argocd --dry-run=client -o yaml | \
  kubectl label --local -f - argocd.argoproj.io/secret-type=repository --dry-run=client -o yaml | \
  kubectl apply -f -

 # Clean up keys
-shred -u key-sturdy key-helm-prod-values
+shred -u key-sturdy key-helm-values
 ```

 #### Converting HTTPS to SSH
@@ -388,12 +430,12 @@ If you're currently using HTTPS and want to switch to SSH:

 # 2. Update all Application manifests
 # Change from:
-#   repoURL: https://git.forteapps.net/Forte/launchpad
+#   repoURL: https://github.com/fortedigital/sturdy-adventure.git
 # To:
-#   repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+#   repoURL: git@github.com:fortedigital/sturdy-adventure.git

 # 3. Update and commit
-find . -name "*.yaml" -type f -exec sed -i 's|https://git.forteapps.net/Forte/|git@git.forteapps.net:Forte/|g' {} +
+find . -name "*.yaml" -type f -exec sed -i 's|https://github.com/fortedigital/|git@github.com:fortedigital/|g' {} +

 git add .
 git commit -m "Switch from HTTPS to SSH for repository access"
@@ -497,7 +539,7 @@ spec:
 See [Developer Guide](DEVELOPER-GUIDE.md#deploying-your-first-application) for detailed steps.

 **Quick checklist:**
- [ ] Create `helm-prod-values/myapp/values.yaml`
+- [ ] Create `helm-values/myapp/values.yaml`
 - [ ] Create `apps/myapp.yaml` in config repo
 - [ ] Create SealedSecret if needed
 - [ ] Commit and push changes
@@ -562,7 +604,7 @@ kubectl scale deployment myapp -n myapp --replicas=3

 #### GitOps Scaling

-Update `helm-prod-values/myapp/values.yaml`:
+Update `helm-values/myapp/values.yaml`:

 ```yaml
 app:
@@ -576,7 +618,7 @@ Commit and push - ArgoCD will sync.
 Enable Horizontal Pod Autoscaler:

 ```yaml
-# In helm-prod-values/myapp/values.yaml
+# In helm-values/myapp/values.yaml
 app:
  hpa:
    enabled: true
@@ -625,7 +667,7 @@ kubectl rollout undo deployment myapp -n myapp
 #### Option 3: Change Image Tag

 ```bash
-# Edit helm-prod-values
+# Edit helm-values
 cd ~/dev/k8s/helm-prod-values
 vim myapp/values.yaml

@@ -645,7 +687,7 @@ git push
 #### Update Resource Limits

 ```yaml
-# In helm-prod-values/myapp/values.yaml
+# In helm-values/myapp/values.yaml
 app:
  resources:
    requests:
@@ -659,7 +701,7 @@ app:
 #### Enable Database

 ```yaml
-# In helm-prod-values/myapp/values.yaml
+# In helm-values/myapp/values.yaml
 db:
  enabled: true
  persistence:
@@ -957,33 +999,6 @@ curl -G -s 'http://localhost:3100/loki/api/v1/query_range' \
  --data-urlencode 'start=1h' | jq
 ```

-### Tempo Traces
-
-```bash
-# Port forward to Tempo query API
-kubectl port-forward -n monitoring svc/tempo 3200:3200
-
-# Access: http://localhost:3200
-```
-
-**Query traces via Grafana:**
-1. Open Grafana → Explore
-2. Select Tempo datasource
-3. Use TraceQL or search by service name
-
-**Verify Traefik is sending traces:**
-```bash
-# Check Traefik logs for OTLP export errors
-kubectl logs -n traefik-system -l app.kubernetes.io/name=traefik | grep -i "traces export"
-
-# Check Tempo is receiving data
-kubectl logs -n monitoring -l app.kubernetes.io/name=tempo | grep "receiver"
-```
-
-**Trace-to-log correlation:**
- Click a trace span in Grafana → linked Loki logs appear (by namespace, pod, container)
- Trace-to-metrics links to Prometheus by service name
-
 ### Fluent-Bit Log Shipping

 Verify Fluent-Bit is shipping logs:
@@ -1264,21 +1279,13 @@ spec:

 ### Backup Strategy

-**Current State**: Gitea daily backups to S3-compatible storage
+**Current State**: No automated backups

-**What Is Backed Up**:
- ✅ Gitea repositories + database: Daily CronJob (`cluster-resources/gitea-backup-cronjob.yaml`) uploads to S3-compatible storage with 7-day retention
- ✅ Git repositories: Full cluster config recoverable from Git
- ⚠️ Secrets: Sealed secrets in Git; unseal keys need safekeeping
-
-**What Is NOT Backed Up**:
- ❌ Cluster state (recreate via GitOps)
- ❌ Other persistent volumes (Prometheus, Loki, Tempo data)
-
-**Per-cloud backup scripts** (manual restore helpers):
- UpCloud/AWS: `scripts/gitea-backup.sh` / `scripts/gitea-backup-eks.sh` (MinIO CLI, S3-compatible)
- Azure: `scripts/gitea-backup-aks.sh` (Azure CLI + Blob Storage)
- GCP: `scripts/gitea-backup-gke.sh` (gsutil + GCS)
+**What Needs Backup**:
+- ❌ Cluster state (not backed up - recreate via GitOps)
+- ❌ Persistent volumes (currently not critical)
+- ✅ Git repositories (GitHub provides backup)
+- ⚠️ Secrets (sealed secrets in Git, unseal keys need safekeeping)

 ### Cluster Rebuild

@@ -1363,13 +1370,13 @@ kubectl get deployment argocd-server -n argocd \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

 # Update version in values
-vim infra/values/base/argocd-values.yaml
+vim infra/values/argocd-values.yaml

 # Or upgrade via Helm directly
 helm upgrade argocd argo-cd \
  --repo https://argoproj.github.io/argo-helm \
  --namespace argocd \
-  --values infra/values/base/argocd-values.yaml \
+  --values infra/values/argocd-values.yaml \
  --version 6.0.0  # New version

 # Verify
@@ -1380,9 +1387,6 @@ kubectl get pods -n argocd

 ```bash
 # UpCloud: Upgrade via control panel or CLI
-# AWS EKS: eksctl upgrade cluster / AWS Console
-# Azure AKS: az aks upgrade / Azure Portal
-# GCP GKE: gcloud container clusters upgrade / Cloud Console

 # After upgrade, verify cluster
 kubectl version
@@ -1468,8 +1472,8 @@ kubectl top pods --all-namespaces --sort-by=cpu
 Example: Adding Redis

 ```bash
-# 1. Create application manifest in base/
-cat > infra/base/redis-application.yaml <<EOF
+# 1. Create application manifest
+cat > infra/redis-application.yaml <<EOF
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -1479,17 +1483,15 @@ metadata:
    argocd.argoproj.io/sync-wave: "1"
 spec:
  project: default
-  sources:
-  - repoURL: https://charts.bitnami.com/bitnami
+  source:
+    repoURL: https://charts.bitnami.com/bitnami
    chart: redis
    targetRevision: 18.0.0
    helm:
-      releaseName: redis
-      valueFiles:
-      - \$values/infra/values/base/redis-values.yaml
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
+      values: |
+        auth:
+          enabled: true
+          password: changeme
  destination:
    server: https://kubernetes.default.svc
    namespace: redis
@@ -1501,54 +1503,30 @@ spec:
    - CreateNamespace=true
 EOF

-# 2. Add to base kustomization
-# Edit infra/base/kustomization.yaml and add: - redis-application.yaml
-
-# 3. Create base values file
-cat > infra/values/base/redis-values.yaml <<EOF
-auth:
-  enabled: true
-EOF
-
-# 4. Commit and push
-git add infra/base/redis-application.yaml infra/values/base/redis-values.yaml infra/base/kustomization.yaml
+# 2. Commit and push
+git add infra/redis-application.yaml
 git commit -m "Add Redis infrastructure component"
 git push

-# 5. ArgoCD will auto-sync within 60 seconds
+# 3. ArgoCD will auto-sync within 60 seconds
 ```

-### Multi-Cluster Setup
+### Multi-Cluster Setup (Future)

-The repository supports multiple clusters across multiple clouds via Kustomize overlays:
+For multi-cluster deployments:

-**Active clusters:**
- **upc-dev** (default): `infra/overlays/upc-dev/` — uses base Applications as-is
- **upc-prod**: `infra/overlays/upc-prod/` — patches value file paths from `upc-dev` to `upc-prod`
+```yaml
+# Different destinations per environment
+# dev-cluster
+destination:
+  server: https://dev.k8s.example.com
+  namespace: myapp

-**Cloud-ready templates (fill in `clusters/*.yaml` before use):**
- **eks-dev** / **eks-prod**: AWS EKS with NLB, gp3 storage, AWS CUR pricing
- **aks-dev** / **aks-prod**: Azure AKS with Standard LB, managed-csi-premium storage
- **gke-dev** / **gke-prod**: GCP GKE with L4 LB, premium-rwo storage
-
-Each cluster has its own:
- Root app-of-apps: `_app-of-apps-{cluster}.yaml`
- Cluster config: `clusters/{cluster}.yaml` (domain, trustedIPs, cloudProvider)
- Kustomize overlay: `infra/overlays/{cluster}/kustomization.yaml`
- Helm value overrides: `infra/values/{cluster}/` (traefik, gitea, opencost)
- Sealed secrets: `secrets/{cluster}/` (as needed)
- Apps overlay: `apps/overlays/{cluster}/`
-
-Cloud-specific values handled per-cluster:
-
-| Concern | UpCloud | AWS EKS | Azure AKS | GCP GKE |
-|---------|---------|---------|-----------|---------|
-| **Storage class** | `upcloud-block-storage-maxiops` | `gp3` | `managed-csi-premium` | `premium-rwo` |
-| **Load balancer** | UpCloud LB + ProxyProtocol v2 | NLB + ProxyProtocol v2 | Standard LB + `externalTrafficPolicy: Local` | L4 passthrough NLB |
-| **Cost monitoring** | Custom pricing | AWS CUR | Azure Billing API | GCP Cloud Billing |
-| **Backup storage** | UpCloud S3-compat | AWS S3 (native) | Azure Blob Storage | GCS |
-
-To add a new cluster, create a new overlay directory (e.g., `infra/overlays/eks-staging/`) with patches that swap the value file paths, and a matching `clusters/eks-staging.yaml`.
+# prod-cluster
+destination:
+  server: https://prod.k8s.example.com
+  namespace: myapp
+```

 ### Blue-Green Deployments

@@ -1592,7 +1570,7 @@ git push
 kubectl scale deployment myapp -n myapp --replicas=0

 # Update Git
-vim helm-prod-values/myapp/values.yaml
+vim helm-values/myapp/values.yaml
 # Set replicaCount: 0
 git commit -am "Scale down myapp for maintenance"
 git push
@@ -1665,7 +1643,7 @@ echo "Remember to delete: $SECRET_FILE"

 - [ ] Application code repository created
 - [ ] Dockerfile created and tested
- [ ] Gitea Actions workflow configured
+- [ ] GitHub Actions workflow configured
 - [ ] Helm values created in `helm-prod-values/`
 - [ ] ArgoCD application manifest created in `apps/`
 - [ ] Secrets created and sealed
@@ -1691,6 +1669,6 @@ echo "Remember to delete: $SECRET_FILE"

 ---

-**Last Updated**: 2026-04-22
+**Last Updated**: 2026-03-16
 **Maintained By**: Platform Team
 **Emergency Contact**: #platform-support on Slack
--- a/docs/README.md
+++ b/docs/README.md
@@ -180,7 +180,7 @@ Reference for:
                            │
                            ▼
 ┌──────────────────────────────────────────────────────────────┐
-│          Kubernetes Clusters (UpCloud, AWS, Azure, GCP)       │
+│               Kubernetes Cluster (UpCloud)                    │
 │  ┌──────────────────────────────────────────────────────┐    │
 │  │  Infrastructure: Traefik, Cert-Manager, Kyverno     │    │
 │  ├──────────────────────────────────────────────────────┤    │
@@ -194,7 +194,7 @@ Reference for:
 ### Key Technologies

 - **GitOps**: ArgoCD
- **Kubernetes**: Multi-cloud (UpCloud, AWS EKS, Azure AKS, GCP GKE)
+- **Kubernetes**: UpCloud Managed Kubernetes
 - **Ingress**: Traefik v2
 - **Certificates**: Cert-Manager + Let's Encrypt
 - **Policies**: Kyverno
@@ -299,16 +299,11 @@ docs/
 ## 🔄 Documentation Versions

 **Current Version**: 1.0.0
-**Last Updated**: 2026-04-22
+**Last Updated**: 2026-03-16
 **Maintained By**: Platform Team

 ### Changelog

- **v1.1.0 (2026-04-22)**: Multi-cloud support
-  - Cloud-agnostic base values (storage, LB, pricing moved to per-cluster overlays)
-  - Added AWS EKS, Azure AKS, GCP GKE configurations
-  - Per-cloud backup scripts
-  - Updated all documentation
 - **v1.0.0 (2026-03-16)**: Initial comprehensive documentation release
  - GitOps Architecture guide
  - Developer Onboarding guide
--- a/docs/REFERENCE.md
+++ b/docs/REFERENCE.md
--- a/infra/base/cert-manager-application/cert-manager-application.yaml
+++ b/infra/base/cert-manager-application/cert-manager-application.yaml
@@ -48,10 +48,10 @@ spec:
        resources:
          requests:
            cpu: 50m
-            memory: 128Mi
+            memory: 64Mi
          limits:
            cpu: 100m
-            memory: 256Mi
+            memory: 128Mi

        # Service account
        serviceAccount:
--- a/infra/base/cert-manager-application/kustomization.yaml
+++ b/infra/base/cert-manager-application/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- cert-manager-application.yaml
--- a/infra/base/cluster-resources-application/cluster-resources-application.yaml
+++ b/infra/base/cluster-resources-application/cluster-resources-application.yaml
@@ -15,11 +15,9 @@ spec:
  project: default

  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    path: cluster-resources
-    directory:
-      exclude: 'network'

  destination:
    server: https://kubernetes.default.svc
--- a/infra/base/cluster-resources-application/kustomization.yaml
+++ b/infra/base/cluster-resources-application/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- cluster-resources-application.yaml
--- a/infra/base/databunker/databunker.yaml
+++ b/infra/base/databunker/databunker.yaml
@@ -1,42 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: databunker
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  labels:
-    app.kubernetes.io/name: databunker
-    app.kubernetes.io/part-of: identity
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: https://securitybunker.github.io/databunkerpro-setup
-    chart: databunkerpro
-    targetRevision: "0.1.0"
-    helm:
-      releaseName: databunkerpro
-      valueFiles:
-      - $values/infra/values/base/databunker-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: databunker
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
--- a/infra/base/databunker/kustomization.yaml
+++ b/infra/base/databunker/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- databunker.yaml
--- a/infra/base/enterprise-apps/enterprise-apps.yaml
+++ b/infra/base/enterprise-apps/enterprise-apps.yaml
@@ -16,9 +16,9 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
-    path: apps/overlays/upc-dev
+    path: apps/overlays/eu
  destination:
    server: https://kubernetes.default.svc
    namespace: apps
--- a/infra/base/enterprise-apps/kustomization.yaml
+++ b/infra/base/enterprise-apps/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- enterprise-apps.yaml
--- a/infra/base/fluent-bit/fluent-bit.yaml
+++ b/infra/base/fluent-bit/fluent-bit.yaml
@@ -23,7 +23,7 @@ spec:
      valueFiles:
      - $values/infra/values/base/fluent-bit-values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    ref: values

--- a/infra/base/fluent-bit/kustomization.yaml
+++ b/infra/base/fluent-bit/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- fluent-bit.yaml
--- a/infra/base/gitea-actions/gitea-actions.yaml
+++ b/infra/base/gitea-actions/gitea-actions.yaml
@@ -1,48 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gitea-actions
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  labels:
-    app.kubernetes.io/name: gitea-actions
-    app.kubernetes.io/part-of: platform
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: https://dl.gitea.com/charts
-    chart: actions
-    targetRevision: "0.0.5"
-    helm:
-      releaseName: gitea-actions
-      valueFiles:
-      - $values/infra/values/base/gitea-actions-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: gitea
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
-
-  ignoreDifferences:
-  - group: apps
-    kind: StatefulSet
-    jsonPointers:
-    - /spec/volumeClaimTemplates
--- a/infra/base/gitea-actions/kustomization.yaml
+++ b/infra/base/gitea-actions/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- gitea-actions.yaml
--- a/infra/base/gitea/gitea-backup-s3-sealed.yaml
+++ b/infra/base/gitea/gitea-backup-s3-sealed.yaml
@@ -1,19 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: gitea-backup-s3
-  namespace: gitea
-spec:
-  encryptedData:
-    AWS_ACCESS_KEY_ID: AgByl2/ljFIHzTD0Vy7srQoXRfdJRLG+WukgeLMJeiJm9MOFJBNEkr5ju2DemDNdRcViXQLN3yxqT/L0fG0rz+kaPQtLeVFToqr58vokxDasHw4WVIUOosi6wE+yaI16H6vxvdV8dck09nHE3fdBcwctlvjqsY7mKvyx4tYKdGRDoeJ/C7shYoDTl4E/ZtsSRkfOQ4Ojm6M6FU10zn03OOKrzaOUczxnqbAyGNFrZvCUGG38QQVnyYm/2HLofQgheSSQx8p0w5IgPRRhBM3IAyCLGkyEA8qHXSO3J5Y2m1izAoU9RVsHAVUMVTfYEdtUMADkDcywKzi0bi0ehBxDs2PuC89Uz4s6rKQ/v8xU+jUf3KogrZxsbuCh1iFVO/NCOLvQhLY5wU/946wl1WmS76/HxkM/D9Iq+KF0VsP0pJAA+SIyJQ3Bh0a9GnKRsJjCfO8qX0M0WSXhOpjw+4DvBoe653mV7n+LOEjQy7LJURFaz1HzQColelhhlQ5tHCN8J1jtjscFNiHZqyzBBm226X3oxr0cAC6e/l53ohNkKS3NA5aM/wouBrscs1/CfmDYKxujLyGqontFRQc3rtCZ29829u/RmuwietIVGeu+ooCacSM73zDqGYKM7HRr/Y7QYxuW0TiSaJhYMZQqsC4uo7ebZhRa2bWbCTHiVCs3jDdpSRyPgEECOvnOJbkTsh0e02HtrUEx7HBjLZua9FD2sskr8C9XJQ==
-    AWS_SECRET_ACCESS_KEY: AgCYxgmto8ytLz8QMm25/nIqqezlWWennhbPSPMB/aDYR+zW45LvAZbjwVp6wwSR/U5iXwfdZg5/k8+8CzGAKDjxc3Nwygih3cUpqVBOl+uOzD3W3oNDsyQckhmNA4jidwIbJF6ecV8O+GVuU19+E4QrkHTIP9lN5pnhkfIR7nMRVj4jdcNahH2O75huadGQII4GG+rmnGX1012IAhknq20CiOCbby3a2yHaU3om0srO1TkW/67jioQX2IvgUh7jVl6c4r1Y6b+glwV4bHc9GecDqNEF6uj6uy8ChNh1khRfUYVysIQRM9m1pV/qlKiUW/wjDZOjoW88IAg4wl2MMOFQby27jVwQWSe+kUPwRMf7HSNWoq/DaE/z71cMsdeEnAXtQMGwNzOr4EGM1n/faPGDWkj306l1xjoXNO2hLCNX8BspSBxQDWWADBGClC6C1AQX0HlsZLV0G18VCEkjTwvPRmPqigxzHganxWiWM0q3DfGrc+JvnGFW0r7waoKI5vIzxwzCbb3I042+3z2vsvo7ZW2mez+eKgeD0MvhRW2SlBMiE62MGJQL2BvTew1iU0Xean+19WGZO7PPysnOH6kU098kTJ5GjQpxlI2C+w6QC18q8eQeIvVyd/7wH+k7RMCDC+No6MCcYhDlcQNbIir6JJ7vIOd3n5NKXdg7Sy3SnjkyDPTOjXTwyn2hHkATMzUxgn/0frNZYSsEMTuoNlOfcZLr7UbFv+Qlr49rkAEMo3deohfGiQSD
-    S3_BUCKET: AgA6ulIpP/DrYOQ7iqo7CSeaSj0L/+PXDPZ7SxPmdu/wrqbXw7nlxAyp+7QHqkUub5XgVhwrk3KPmqUPcECPDbHdt93+nlM3PVD0yPNkVaijncEPRVccGu/VhE6Nae5lXI9U3pnAVAXn+7z8iwRpF/vr1qIGyQwiizsKyfBQhvRSupzOvY8sypbItDjyjttxlwMRorGI94GObeUS89kSx/MB7BWZJMtUuRRSG6YwgH/XIkIWbo2p2LD90EhNtaT9rYa1PcGP9BVcgHf/9zVCI4+1LWbfmZSgobwAEKLhzZfhzCM2DhN31CsVWhpp0x0gYmspNbtQQvoosKmeBPBT+BLkTabAhjx00rvVX3J48Er3PaVAjw6JxT1KSdaUuCmcIzX3O8ys/8PNacaEgEiqmeuIPgID8YHSXSfs9RIUkjKBWGydjE90lMQPgnqOBkPWTd1BNRqHj60D2pFp0/h7+j8/OfBj7doDp9ECwcdQqjwzX4pNi7WQiGd+Ri0/7DK1xSAOL0lwgg8VSrqCOIdasAZRVQuHhuWwKMyhdQyQCr+zCOQ/bLQaPeF1m7tKxFfU4lNz5tRiC8AOQI5aHX2gRrkpfugD3G9qFFQMl9EPCdNeBh/ezVWxSxekWvQTuGJ2WnLD33BhsZVLKjXa+tHjD/BsQjQgdCiqv8J9gPgtngx/pAFf0NaQezVU4tBfaYD4tetcrZDz5UtW5tTHaF4=
-    S3_ENDPOINT: AgBfKbxdU9hZrxIpbM6b+hDthXQ+uYrjWHGmxSdjGvxgHB2P7E+HqblPAHjIpiAsGiPESV75ZKs5/BdEBOoZpbvneAuRgVLZ5mxkWiQ35q7sJpWaUg47icnlEPFoFj8oxYbi1NRAYB5hbc3AU0s11mw7wre0pRZu0pgSidHk/lyuSXOHKQzuhXxKYmV61LjMxCQGwDNwbiDNuSZyU7AZ2r+vr2W7Tzu6G+tJctwQd3HOnYbOLMV4tBv93nc7EkU4tbdvdIvkGHEmKf4r4F+nGvKZ3fZie1QKyQvG/4+i8OKqby9XJtviEEfBqfrk5qb1dNQlqCfA4ThQ11MmRiP8VoaUp/yoUHHYACNY9HLBp+N5Cgbbcxo044U1c8b97I6ZOZJ2waZ9XkrBpYPPXWJRKxLeNgYoJqn3yMZV/U561DO1jLZ2cwQXXaFrm1WT7VjcB0czdJHW3FcOg9lzYKMCCTTX+cD4M1oK992931eECQxBecrtlQYD+NlJng8ARm7myTACOZGYMQo2gjdM4ZBh9KqoCT2jrFC6E29YwfRAIXrhiWdZZxOW6Bu9Txt8FgxnIlSz9iZ1hvbfdvrSZTilJbAAULKFqLUgNpQbdgYHtGXQkzFHqYmbdZ0vJ6taIli7y+/Rz6xKcql8uJLxnuncLvLvXHxXl+rWeKrAMn+jPvnuCcdq6yVPsI0Nz/B4EQRL7Nzl9XYQxSybAJACrrCjgEuHsquoPpuznlGuk2scuakXdWOzMg6i/MEk
-  template:
-    metadata:
-      creationTimestamp: null
-      name: gitea-backup-s3
-      namespace: gitea
-    type: Opaque
--- a/infra/base/gitea/gitea-credentials-sealed.yaml
+++ b/infra/base/gitea/gitea-credentials-sealed.yaml
@@ -1,18 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: gitea-credentials
-  namespace: gitea
-spec:
-  encryptedData:
-    key: AgAN7QteEqfzTrlCRR4Hi50nPJ6GGktFqOJIMgYvAL+es3ELUy9KLGtcyaC+Bf+b9lmG5+UgiCdz8jWbnVI7xEhDKXx8+3KzLw3nPAhYPO3j4XSi3FhbHwE0p5IGlZ0/XdXP5SRr/X0P6wQewapLSClGoya/ErY549ORfL0KgbcUrPE4ReSKbER6R/biRzSpkngxljf0rw4uruhNTlmBvnL/0nRSdZGtww7fLhcQceARutGihKHjOTkzmv0d39hHJA+4xNTi4PCbfOUJBkKwriy7NTi6AZkGRH2b06m+/IGfYYvTp/2gdtf/omS0ZhIoEVeRLhupiwkRAlclOSk3EXRsCcMiH8Gp5Mp4lUuc6yYHwM9ONAbq+P2OlUTjNDOntgH4Z6p02D3pIUf6nterSTuga7haGr5Ph0OCYBk/V6KkswwuTsSBAv7EI5TXrZoALp0xxXBXS459sc21UCgp2K5Xdhb3K92KwtcQDND7qAdIVZXAgf1wahm2svjRWhvjnRVLqChbb8MvkEQC+queHvQvIW+/5mCEb/hAEY/nAHJqTqQhsHnpPxzMhLvxN+7S2zvqSC48zSVAbKvwNjJcaiZ3s4dTjgCaryT307Gg4FI9bHixtk30fB9ZUkMu1cm51QC8ld5CBVKLMi8mHSezshiZ1n2PVYMiOivbghDZQxJ+uutZVOlrF65uAtgnQgmm9q/fTD7FWQ==
-    password: AgBdnjk041bBX2rwz+q1G6QDk+QrHfvuzoTo1pCRE1w7NLACFgGwzeSTS7gjPXwtjIkgganpZYgT9ZwWK8+gcT6Sae/CBTcDPgE6Y7FtfpG244wgp+mn891TDQXONW/OBAYk+706YDbHfqqz5AQxKAEorJ74RZuLTAo6kB85A/eveEnQqq4cByJaInz0eprB1A4hGfBLF3XArjiVdL7f4X33mR4scH80GozJiqUnG6ruVv5jcEBXnzySVrnCaq4VgmgJTu5Lsjz+AyH7niGTGFIsVBeOnVyeodKwgDk4N3HeSj4w9No3ileZELD5nLZh+/OqdQHw2niBz5/hPjDyXw/p96PfLM3CFygXfs/Au1DqdDf8ccZufhF9OK9CCQqlIgCWK3W7lhsdhcgK65XisRG+hh37Vcxke+A9ZoLGMjIT43KejTqwE8r3wRxPrmejBUcVHohiD7L60dFbcUp64hSBktcIGwEAWn89gmD7Ar1gCoCUmFCBCTVD8c5LQ2W2xeeZ1OrtDpMkOustzXUkzqkqiCB6TPMqDQ4J5FXCyoTuHrBnieLWaKL82kdUohF1+Jak3UGe0rSpOxBmoNC/17yVXyiwBGOUZZP+DJyvwiJu1jc7j3USQ0HRCcR7af96IcwGxge4yWbR268oI53yiJlwh46JFcc8RkxQQaq3Nh3RoiGJohqx/or8JOIFsXEtUW4WSLNQa2tZ4dxRI8F83JnBCo2W+zvL2yXKRP/LLMXfF7nAOuXPrYKrRcdnnRhP1cdDUSIQk8c6gzvKJrsEkt/j
-    secret: AgAR/5Tj79Rk4fgvPwvRU63q2xF0fokEe0/KWQG9CGiYWwut8wB8PlST5WEcKWIjwNfGpSsyHRQHywIVwDT3m+3/wxfQ5eOtlHIfMuglSymqeLHvj9tuM2EWabd4o9frKHHJigNojXS42JZ1jVSW+PeEfNrGFBARWWaDYSA5586/M8U5qi6UOBIkdyG+796wqqIeUM52d+/lwHHcETQOdhwa5/B4IrbRB33CSv0UHmfM+MeNtUWEnza5+8tm+1mPFyBJ2N9isXxMeyHXWutwOJVsAjEe+X35mC1C03eIsDjpmpjQ+hweUhinu6zse7CsIwcBDuq4/+1xd8xaQ/lmYc01FophuAcVRqDZIhlaAjCLI7gCfX2fliluVuaUbZ/A4DY8Q/psOteODeI0kVEMCaL13T1j6tZZWyDqDAB91xKFh2ne4DOOTwkZLP2StMt7rAENy/eMld+VNrfNliHJUVJGMoPTzCxPaZQxJfRYIbpE5uGGA2fWkteuX5VJRqZ/8JshdBAUVG1XOSXlvM1zlW9KlyvO3j3KhekKG7bY+NndIwFMNhujG3FGWCA+k3MYQfAks3FWhW+ZXA0vYZpnPOJuYO5tqqDO4GLsrdJc5GaXMC7kcey90PqkwzkwhpxX7/X414w3bHWoYttmFCcQwSyA+S029gSFBIleNTKkjpXsNl8qB2NDJR1lf2kufO016WP07PB1NK0hGjvI0isz0uHZILrAD0i55t858/EjWsD2gg7jK2ww69vVxi2c2o6k370YVv92qoZCayTuYsXF0Ay6
-    username: AgAmO891YOV8ZtWTNjOF+ZA+6yG69Jdvozq49/XCQabuVXSqoESWA/V/6RPL8+up8dFa+c/u0J+s+Pu1cJL5zjZmJtXStOIuhoIGBTkWBPgHQ11hp/5apkR4nt0gWR3fWQtz1v/073WsaQGhEyKHB4ZsxAXbwEQ41f+TQzdkvxu2DT07Kc4O0jN+QsAl/YtPLk2YW2WaiY/Q7dDq5+LKAbKVRR4Aa03OuMVDapPGOEogu3wC8vl9lkYMhPBrIosq9ycqk4roenKbtmFSIkzytLOLRKSNEmPUSklDMrO8HEGSByASxJP10jgUZW9wY4lE/DmsjuS2CQsGLXhZAye2S3hgGyewnIA1ZfsnJTb7jSsnQ0BVxm6HL9lKy/1PqDzMuE0Ou+LHiIt5DLbCrDmn0F+n8jhNlpCbtiZXVL/Tvo7SAruBe858CYXc2StFHNi5hA1dRP2CCGklY2Wmi8u5JeOdi8RXdhw8deZtI0G+I1NltqzhXdDR55kMWahy2BTImJrGj8owrdg5bFz1Ne63P7jiS80BeUfDKffYAWuslDEiKkhO8YSoVj7ixeWIfXvZRyaecaCMcZ+VuNlZy3R5CbFTcIyZkfotK0+aA9S/q+iM6K36ghTxpQv6WSecnHpeR8mkVckCGVo+iiCPIFfQw2VwOHn+BtvbH8pfr0McKoGHAvoDGGH9sjgDbjAGwCYFYr7qHTKaFc1vbVcUNw==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: gitea-credentials
-      namespace: gitea
--- a/infra/base/gitea/gitea-runner-token-sealed.yaml
+++ b/infra/base/gitea/gitea-runner-token-sealed.yaml
@@ -1,15 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: gitea-runner-token
-  namespace: gitea
-spec:
-  encryptedData:
-    token: AgBZkU9AgXmFoBURd4WImEFFY4k3LTvGmMJ0ZEZETYzQNS9ICyM0TZfK9nF/bSY48y9t2Vd+VNNW2WJhqec05HE9rLe/vQmo2L8OlBLbCpFL9vCEFJ/h8AiWdHGsLJtCH6tOJwBQ667KPfAGFeYZzKf1XF5HA8O6G1+v7kO3mtSNSIYWq7S/swe5QO+bgtclkeDjg3xgOhjYTzlOsg+rcTknhwGa2YpL22rFN6Tbf94oTK6xVBYrkly1nhiALGYyGnROSv/Ua8+M4xEF5tr0QslwjRmzaQTC+Skt1HKXogsWVzE03RZHWQpmcz1ltaKfikl8WQwBmOBDeg9xNRfBu5n5jli9NvdKZgMEIyQQZtp27QCsIk+FLxbAb2Zy/hG3G93Jvk9mRzgryXyi0te8w+iEP1WtVOYHSyLmk0AMCahn2hPIfzQvlOXJxoSFhLbwm5eSwtqYTQkQ2WFKmwaznSZBUmk1a+LvxV5pOhPMvc52w0v8u13ng/YzDDnyjY/6WdYX5pJtYOGUFDt79yd2Bd0Hc4CH9y50dy84YfdlC/prgTVeVfoJFW48qhE4sNkBhL28PjgkcYmIOb9fskP1o3RuHIoR28y9ipZMkzdLimCRzIQxf4GmdOlGsoEEvujgiGr1ta8ilRoAjjDAD593PuYELFRfGYjk4KGNkz6MP3t4UDRlG8umXMQIqhEWUaRGytqMnfrPGiGPAGCBfAAes3mooDNO/NO+WwNq09fd1OWFeDvzJMOLxWLy
-  template:
-    metadata:
-      creationTimestamp: null
-      name: gitea-runner-token
-      namespace: gitea
--- a/infra/base/gitea/gitea-smtp-secret-sealed.yaml
+++ b/infra/base/gitea/gitea-smtp-secret-sealed.yaml
@@ -1,19 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: gitea-smtp-secret
-  namespace: gitea
-spec:
-  encryptedData:
-    password: AgBMuISQeA41mtBIOo686sND2EO12Jv7BIogL5G7xxt7wKfIk88dQrU74vs+fv3OtPce2Ra63QkR6po31M9fZkoiYba5yqJtEOc6em3y0ZxM/UzavbRvHwrvsWEYqmHBnkCUjcJijdGbSX+rHyGsXLfZO0gOjqXO379Zl1fzmV4p3F5REXFQm6HorVtWX/LOSRj9GDW76l6KgPR/A+CbtAx8Cq0m3D3fyiaVLEReP3uOgBOo70APHj9Yp56EcgOtVa1pEgCxR4ctXeS4t/EliWcHc/JT4TBdRBRDYPKLfME6FvJxjLjaSZcWxtJrJzCv3+vA5LlfObuHY31aSDRqYwO4VBCPhf3Aa6Z5UXgUnmAtJRhHa9pKSSjW48jgNb1jDPIkQn5XgB2/twJ+gX3inAkrTQ82JJ75Rz7XWC8KmYkOtkgXgU2buCa4nIfPeXOr5qvutyywxV1Ge1nK0fQYneQZVFXlHTbAQXBJMpVvJoJ+G3xGjm1904/iBGkVKmNrQwaABUsGBC6ZIHGOTa45GBqrg3ODU2Gr61SCYxv6m3pMU1msR7QYne0oqLCVD8mLDaeSeiQI4ZY9u4ddsVwM6l2BFrT6+3IQuYPBgOoodzDVlCgmA7hoekhpak9vZ0loSHaWDXdNt75SemAjsQfwCO5sSEkr+wbCJEQpXh5p38RMZKTuOh3nYEGQEx/MQNl3VD4FarK/zOJM9EO9IkqdM4LnqVo3zPX4KAPosS1PPKS8
-    username: AgBF6MiaI1x2xQOUoF4NUh4MeFF64Db3vywcEO0FdJ0U9EirVFMsBSSiqJLy8ok43ha72s+/RLBNHiSSRKX1UMWwwCsfs+LQJNh9EetgHRxoyqkHiqRMX5V2acU2scdPE/FCFQFOYzAjweup+kP8xNu1WKuDtPBRiAgBNDfW59ihFi9TgOJQ2AnDHottjm5CNaWsbTOSgZrXqzCEChfHu5K0W9cty9ENHYqnYDfcm/zPLYeUPW0gVN5GJq3lPo9vZjM7T2JnwryjOkBaPCRCzHOpRF3bMrArFrjbUlH6gdI0APf4CzGLMMKol/jTMG2tLBseaNQHfbz6p1vFYExCL60gSN46fzh10zIWaIC2O+SgoLLOizkQZWf/v86cdRerBSl6PFmbRUO18XUQ4SyR/WPM71HD1jeLnUZjKtkOu+fqQKlv8kBSELHGqiURNYDnbmUA1LQpdNkDnMkRS+uzQ3XwWCSQBAn+u9wh69kg1oPVEN60Nc4KpNwFIg25aycGkP3cMklfl3/u9nr5KruwtJe+hl2ynSk8zeEFWWQrBki7+88CH9aWVW/GTA8Ho7Fz+gp4ZUdUA0WhH2LRAQIN945pvJIkHm/AYAhH6pZiXdBzYeguPY5VEf6hDVM1sa39aSZzs81cj0YHxbjR/BoBxbUAa9xW7JYH2rcIqXDhJB4zq2H++8e0eABsdQC3tMmE1eQA51d0yg8+2fX+CRkcvMCmI3VjS/mdirrtnctv
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        allowedToBeCloned: "true"
-      name: gitea-smtp-secret
-      namespace: gitea
-    type: Opaque
--- a/infra/base/gitea/gitea.yaml
+++ b/infra/base/gitea/gitea.yaml
@@ -1,53 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gitea
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  labels:
-    app.kubernetes.io/name: gitea
-    app.kubernetes.io/part-of: platform
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: https://dl.gitea.com/charts
-    chart: gitea
-    targetRevision: "12.5.0"
-    helm:
-      releaseName: gitea
-      valueFiles:
-      - $values/infra/values/base/gitea-values.yaml
-      - $values/infra/values/upc-dev/gitea-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: gitea
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
-
-  ignoreDifferences:
-  - group: apps
-    kind: StatefulSet
-    jsonPointers:
-    - /spec/volumeClaimTemplates
-  - group: v1
-    kind: Secret
-    jsonPointers:
-    - /data/postgres-password
--- a/infra/base/gitea/kustomization.yaml
+++ b/infra/base/gitea/kustomization.yaml
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- gitea.yaml
- gitea-backup-s3-sealed.yaml
- gitea-credentials-sealed.yaml
- gitea-runner-token-sealed.yaml
- gitea-smtp-secret-sealed.yaml
--- a/infra/base/grafana-dashboards/kustomization.yaml
+++ b/infra/base/grafana-dashboards/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- grafana-dashboards.yaml
--- a/infra/base/grafana/grafana.yaml
+++ b/infra/base/grafana/grafana.yaml
@@ -22,9 +22,9 @@ spec:
      releaseName: grafana
      valueFiles:
      - $values/infra/values/base/grafana-values.yaml
-      - $values/infra/values/upc-dev/grafana-values.yaml
+      - $values/infra/values/eu/grafana-values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    ref: values

--- a/infra/base/grafana/kustomization.yaml
+++ b/infra/base/grafana/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- grafana.yaml
--- a/infra/base/homepage/homepage-extra-rbac.yaml
+++ b/infra/base/homepage/homepage-extra-rbac.yaml
@@ -1,21 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: homepage-services-reader
-rules:
- apiGroups: [""]
-  resources: ["services"]
-  verbs: ["get", "list", "watch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: homepage-services-reader
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: homepage-services-reader
-subjects:
- kind: ServiceAccount
-  name: homepage
-  namespace: homepage
--- a/infra/base/homepage/homepage-widget-credentials-sealed.yaml
+++ b/infra/base/homepage/homepage-widget-credentials-sealed.yaml
@@ -1,16 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: homepage-widget-credentials
-  namespace: homepage
-spec:
-  encryptedData:
-    HOMEPAGE_VAR_GITEA_TOKEN: AgAVN1C931EQpn+sodr3CpjlhORfJVTW8aUr+pGZQb+65Pb8QLGeVGVa7Jv60gDJUX3r+93/jMrEbCOeDL6I4qCz/V35wMCxFZLnXIdkmto0W4MKt6cK8To1/OP7EhQJOGBlSuOFsrwoy+HDtvLIqmyF0nrxhTusm9/NHrw+gCVwSTPhiAX1MCuSOSRWpbXvyNphW8j7aqUaV6ixDt424Fe4alEIShYELcS3EX/VPgsf2p2bhvBRCQOh3LEprkuxSFMuPfCBk06TPTbIN4saNVm0Ke0zW/pxkVNSiIxEnKjOmpPJtacsfWN7du+nQbx276G2qvWrf+iawJVq0Z/SLikA/NUFBL6EjSRfgE3cSOri8sbxsd0AycsFGyp98EM29wE+WOQl52M/lwl02EmCivqkICSO7Jp9pM1ScbmRMa5vcnupsGbVDxhRKLqxhAskt/BXDkRzvHN31gH3YmelES3JuqNMHV0urFxmX2oOX9Pxbtv63csc+zhy1Ui5aoex7TPnLdk7kYLSAE2MSrzT6wHvVhBC5kNnDYVrLehvJrT+eNh0MOLx2wkuJmIOxRAGUyNi5DfDnP6qnvj2aefEymLuOXAIUXH8DbeBtrjsd74HX2hhIfBlPkXvhJR3ks7i5RXjK2/YYHkgJ+nJoW80S9N7ciaRy103g74TNJZt6QzzL5Vb80qZ6yQOD4G081KmTLDmhHjJVIIv9M3nLh2s0IeBV3/Z5qHZmtjN7sSaKAn4MIr5FaH9quhx
-    HOMEPAGE_VAR_GRAFANA_TOKEN: AgBloBlOlP+R/4VizE1CGpj0wyiwU14BemAnuUpld7OvOGc67dwfDPyponkQXjAZg3UU2cZ70A51WUAuVlAr+25Ktlf/FW2OBqj+1BJOCqMMyu+kv026yjX2aB8dKGzlTxgF8aji+j1mC8vP3vvmgI4Zf2HQAH7uFwLfeo8+QnV5EyhcExSS0xDne+VtOP9jNXbPRayry0DdyRVtaeKAiZacO+45oAJWszWOwmoMTg9FZQkLjER6Q0tyI6NnoNObsFCnh56chZTdzBOYtmPnwld1bP2FjoJDqn8AfRwbPTIj7t0eFP7WLUO7GQKpxVl+pFwJLb5xCOw2+HNtp1BhNCu7icuc0P88IlvwzkbN0lXJbYigVOzyjEo8f/al1DXPM4WaB/Nqmr7Mtt8KTRh2WMVTgiX5jsu25D0rGDvY9gqfBBqswkRhCLsG0v0EN32zXj1/52KYdmB7pk/+2lMwSaGMS11MOenHeU1Z95fGxm9f3EGF0E8xlFr4FowgsNwr+tJQqpM0bT/4mZnaQbGWtKPFizMtsfQFm+rHFcNCrGaOuecslmiIJs8lTm18KlrncsGfxNS64tVXk+LvydU0rwybvpg2rQjEWtAl1IQsaaiz96OAlYxxK1MGxN7KE6F8R4kfnWTZ5Fs1KMmd/DOIVBXyCbqXxk8pbekmaIeNSfv92JNZ0QNJWsBa2vgQ24WI2pb4XiR0BvtLpt3BVlZUcSK92SzUblWmYWVMwHYCJkEeEUV1PhYEmyiN+V/Kq5Qb
-  template:
-    metadata:
-      creationTimestamp: null
-      name: homepage-widget-credentials
-      namespace: homepage
--- a/infra/base/homepage/homepage.yaml
+++ b/infra/base/homepage/homepage.yaml
@@ -1,43 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homepage
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  labels:
-    app.kubernetes.io/name: homepage
-    app.kubernetes.io/part-of: platform
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: https://jameswynn.github.io/helm-charts
-    chart: homepage
-    targetRevision: "2.1.0"
-    helm:
-      releaseName: homepage
-      valueFiles:
-      - $values/infra/values/base/homepage-values.yaml
-      - $values/infra/values/upc-dev/homepage-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: homepage
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
--- a/infra/base/homepage/kustomization.yaml
+++ b/infra/base/homepage/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- homepage.yaml
- homepage-widget-credentials-sealed.yaml
- homepage-extra-rbac.yaml
--- a/infra/base/karpor/karpor.yaml
+++ b/infra/base/karpor/karpor.yaml
@@ -1,48 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: karpor
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  labels:
-    app.kubernetes.io/name: karpor
-    app.kubernetes.io/part-of: developer-portal
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: https://kusionstack.github.io/charts
-    chart: karpor
-    targetRevision: "0.7.6"
-    helm:
-      releaseName: karpor
-      valueFiles:
-      - $values/infra/values/base/karpor-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: karpor
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
-
-  ignoreDifferences:
-  - group: apps
-    kind: StatefulSet
-    jsonPointers:
-    - /spec/volumeClaimTemplates
--- a/infra/base/karpor/kustomization.yaml
+++ b/infra/base/karpor/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- karpor.yaml
--- a/infra/base/keycloak/keycloak.yaml
+++ b/infra/base/keycloak/keycloak.yaml
@@ -15,16 +15,16 @@ spec:
  project: default

  sources:
-  - repoURL: registry-1.docker.io/bitnamicharts
+  - repoURL: https://charts.bitnami.com/bitnami
    chart: keycloak
    targetRevision: "25.2.0"
    helm:
      releaseName: keycloak
      valueFiles:
      - $values/infra/values/base/keycloak-values.yaml
-      - $values/infra/values/upc-dev/keycloak-values.yaml
+      - $values/infra/values/eu/keycloak-values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    ref: values

@@ -41,13 +41,3 @@ spec:
    - CreateNamespace=true
    - Validate=true
    - ServerSideApply=true
-
-  ignoreDifferences:
-  - group: batch
-    kind: CronJob
-    jsonPointers:
-    - /spec/jobTemplate/spec/template/spec/containers/0/args
-  - group: apps
-    kind: StatefulSet
-    jsonPointers:
-    - /spec/volumeClaimTemplates
--- a/infra/base/keycloak/keycloak-credentials-sealed.yaml
+++ b/infra/base/keycloak/keycloak-credentials-sealed.yaml
@@ -1,17 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: keycloak-credentials
-  namespace: keycloak
-spec:
-  encryptedData:
-    admin-password: AgCPuUHRhzPEau3aH9UKq9gp+k5Pu+lPKizST30OWEOW9ozwdcHbq90eb3b5Sd+R/fRPkqta/8TrhZx3uzqNhVnMUSSwfcnxG14Nfq9yl/CAIuXBrPH1C+SghLWrGcv/CaKwT1arTk/ECjtz87vfpGXwqjjRc3rnH1fRjMTsIL6vwOLKIad6dXREzviUGoyxWp6U7A9QPUQqAApRY3zF5cSH603TYiSd8+EIEVViaAAQDg/2xaknbGsMi6M9Ei74IQIFoYRHarMnpkdn7AZnbX5u/bpIOmjMloUazVg8DhPHlc72QiRzqq95YFwfjMqJumOZwS/Fo4rQXoyKM5/aUe0j6zx0wgWk+MNHq7JUjdsJcGIrlgFW4Um9oDhZbYiexDmwG6cR/68fKLOoFpVx4gyZH7Is3+v6l/EYm+ssARU0e+28xA6ZVGm7YhsrgjLmPd3z3YmVafgFWpyEvIGkAKqHNmWD0txIZ3LWptISqwjcr7Yk63kPFjnuXS9t3nWOzSF/RXnLgM90ZSkoytZU+CwyjAHFf30qRWeMvnXB6Ry4g7Koz54jpoMj0Gk9Fqb0v60DgOd4yxhTbT91Z83x2SvKeucnbDB8IK4xMK+QNfKy20BbCHLGfY5kCdYxIUMNlB0LUsjDOnGjqCrAUZjkeHNI04jNvHYMItgP4/EgTU7NB1f/GsP6cwwdwbKmpHoFKGBPIPo5iMUKK51/U/da/1Zm3f9Qr1HrKQ==
-    password: AgACslplMgI3ZXPpx7BivIM8LIhNDD5j38wbzd4H6IKqZab/nTNpmz2Hc2hCD96H4ljhCIiw1mETzCWshu3vwvCVtJnH2pXiVY0nHpJcSH1C/HqBPOXWVEuEcm2EgvKnf8koKdtkHtAaT6egWrpvNEHCnapo1pa53qB1cZk0PbPQ+cIcedVTa6yF7VzFcOQp56mbtu8ez/iww+K/SdiXtp/IkVCaiOsC7j5ZUwZVmPB/w/nEjgPPETezy3OsOaAokelKq77EUfrj4mh2CEtK9bHBRkbmZkTc9pVkKC/SuWRud5S6xV/VcLRdy/EA/wuqj+Z/XF3hOqyHUpNblbntZ60lqwxoju0ZK9hgZWwZyNvzz04/gv0TkX3/W5JTxNwemJ32AjQ8dQZOz6gdkTsX68lT5P4YlR58Dxsb3WxQxG1ishkDlxGCBA2oQSyyIMFULETuu47V32N8FXOy5fgWHO5ZSer5yFjIIjgU7GyywiSesvZ1m9G7lB5EX56ay1djEmUPiKP0KDyb3QSgsaVbUEdTDi0bXXyDgoVBZEgQNS6vttd5b4qV/IGDqDB4g2hw5xLiff2vkF/h0QPGEz61O+FDyYP5m2rR37o5lD6yWJGI6cB/epoFTKVANPyyGdrIDKtVlgEE30w/fciq+FdDRZob7Yg4uzXi/kGvAYfBmi0Ek04EIU1FLdEq8p+5yZhDSBy4TWjTuH5JTvYlwHjFhnLrCHC/zCBSgkOPgUkAGNOHdTya2ElqEGSSfcRrrvMhnY6ZlZubhGFSdPSrZSXTauSo
-    postgres-password: AgB/qqkiqoQ1d5g+ZMF5Za0ZQ0kpD+6sh/ds9/uc5XBD4VkaX2+1EDrEcq776x/thbngR1Fi3HNBafRtflfptO64N0r3GBJiakVIT+fEdp7tJs6VKjqcP9HFAEObAVEdlcJzOm9h8iPvhi+kxGgkJYSP3ojJ/lfoWoMLtZjsOJtlQH8yw0uPd8xlgVukssxUzFKkT2RkihLwlK/Zn/8MX8BNJT3W9Li8ruK7pm0+qKqsPKcq0hpKHVRDyYpWubAmiGtj8+Oe3qSYoQxepIdUvtEgEXqHJ5DFggxYB4VzVErdKcyn2tK8JraofcOYpR+JM+8VRH/HWTp0/zNJzY8LCgN/V+KkPkCghVDryW+8ZS2FSP/bcqhPWVbQE3s9EblUny8htsOu2GikbbQcF4LzBKDhIJS6hc9SUbw5sfT7CtREcU7XCfq4VyX7dQgOdiGotO8OTmpXFZtceX9E8ClGTQ3V9tKZkzlpILkEip3PjbkkLshNTtJaRsFgRu37PDddUHaVczBoPKBelONC+KpKBQDoiTfB08BylNxdROsic2ag3upR5avOuqf0YDU6tDKBP3S0FPhPoZOmisUsiZNc8/QqV590gSUvqNBRDWWbqLtYsHmgeYRKDH02kiEzIBQuARryOjK8gOxmv0oo1SVdOd33Q1smU/W5YQNqtoVcqRQOtn0lR/cfQjtHJ3OSSNBZuvEx0BMUsLkH5Oud6nmnVITxT6gxLOS6K/BgV8WyUwgaO0r1sFdjiArCQcaDTjLHkAopYjgWsjEkV04XdjxssEJB
-  template:
-    metadata:
-      creationTimestamp: null
-      name: keycloak-credentials
-      namespace: keycloak
--- a/infra/base/keycloak/kustomization.yaml
+++ b/infra/base/keycloak/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- keycloak.yaml
- keycloak-credentials-sealed.yaml
--- a/infra/base/kustomization.yaml
+++ b/infra/base/kustomization.yaml
@@ -1,25 +1,17 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- traefik-application
- keycloak
- grafana
- cert-manager-application
- kyverno
- sealedsecrets
- prometheus
- loki
- fluent-bit
- enterprise-apps
- cluster-resources-application
- kyverno-policies
- gitea
- gitea-actions
- opencost
- renovate
- tempo
- grafana-dashboards
- karpor
- databunker
- homepage
- vault
+- traefik-application.yaml
+- keycloak.yaml
+- grafana.yaml
+- cert-manager-application.yaml
+- kyverno.yaml
+- sealedsecrets.yaml
+- prometheus.yaml
+- loki.yaml
+- fluent-bit.yaml
+- trivy.yaml
+- enterprise-apps.yaml
+- cluster-resources-application.yaml
+- kyverno-policies.yaml
+- secrets.yaml
--- a/infra/base/kyverno-policies/kyverno-policies.yaml
+++ b/infra/base/kyverno-policies/kyverno-policies.yaml
@@ -15,7 +15,7 @@ spec:
  project: default

  source:
-    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    path: cluster-resources/policies

--- a/infra/base/kyverno-policies/kustomization.yaml
+++ b/infra/base/kyverno-policies/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- kyverno-policies.yaml
--- a/infra/base/kyverno/kyverno.yaml
+++ b/infra/base/kyverno/kyverno.yaml
@@ -39,10 +39,6 @@ spec:
    targetRevision: v3.7.0 # Update to latest stable version
    helm:
      releaseName: kyverno
-      valuesObject:
-        grafana:
-          enabled: true
-          namespace: monitoring

  destination:
    server: https://kubernetes.default.svc
--- a/infra/base/kyverno/kustomization.yaml
+++ b/infra/base/kyverno/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- kyverno.yaml
--- a/infra/base/loki/loki.yaml
+++ b/infra/base/loki/loki.yaml
@@ -23,7 +23,7 @@ spec:
      valueFiles:
      - $values/infra/values/base/loki-values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    ref: values

@@ -40,9 +40,3 @@ spec:
    - CreateNamespace=true
    - Validate=true
    - ServerSideApply=true
-
-  ignoreDifferences:
-  - group: apps
-    kind: StatefulSet
-    jsonPointers:
-    - /spec/volumeClaimTemplates
--- a/infra/base/loki/kustomization.yaml
+++ b/infra/base/loki/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- loki.yaml
--- a/infra/base/opencost/kustomization.yaml
+++ b/infra/base/opencost/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- opencost.yaml
--- a/infra/base/opencost/opencost.yaml
+++ b/infra/base/opencost/opencost.yaml
@@ -1,43 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: opencost
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  labels:
-    app.kubernetes.io/name: opencost
-    app.kubernetes.io/part-of: monitoring
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: https://opencost.github.io/opencost-helm-chart
-    chart: opencost
-    targetRevision: "1.42.0"
-    helm:
-      releaseName: opencost
-      valueFiles:
-      - $values/infra/values/base/opencost-values.yaml
-      - $values/infra/values/upc-dev/opencost-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: monitoring
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
--- a/infra/base/prometheus/prometheus.yaml
+++ b/infra/base/prometheus/prometheus.yaml
@@ -23,7 +23,7 @@ spec:
      valueFiles:
      - $values/infra/values/base/prometheus-values.yaml

-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
    targetRevision: HEAD
    ref: values

--- a/infra/base/prometheus/kustomization.yaml
+++ b/infra/base/prometheus/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- prometheus.yaml
--- a/infra/base/renovate/kustomization.yaml
+++ b/infra/base/renovate/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- renovate.yaml
- renovate-env-sealed.yaml
--- a/infra/base/renovate/renovate-env-sealed.yaml
+++ b/infra/base/renovate/renovate-env-sealed.yaml
@@ -1,19 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: renovate-env
-  namespace: renovate
-spec:
-  encryptedData:
-    RENOVATE_GITHUB_COM_TOKEN: AgBliRXcjCrWeZKa3A0RuQatvluoF30R8HEAt7aVJwSf9EbMtB/ozbtsbHxYTsyfpdnaewD+BMRbaDdQOTpmlPxfK5eqKFuLXJGCXmiiMEHvK3GG0y0STjfgC2GyrXvtmh/lg/Awod9ZneJ2+Xoi0X7ZIngWwHXmgvsRfczKtwZAZm/YVDLGHRW2BCwBgzStZquopxYGQRa58WSx9XkE/cV8UOb6Kw+4fGMKggJPr8ERUQyermCZ0HBOpkQwPpWoPhRFdCMj2qasVLttkK/jLG2romy3JZ59RGrQ7bj2p9IdJujqtteWb4vDdOc4jvplKWlB8QptZ872a2MPeyvopqkCsmnsfi6tup6uBaUzE8Hym0olpqK73dCjc4RP7x64KwsdGOyi2aJgEz1/Ro7GMu7sam5sdpTjpdA3EbyC8tZrnlC51mUlq4ghP5XELGj6DjvLWZ3dk0UOSQ4vQ/KLGyA29VBgvV3MdabpGNhs5VlU69p4RofxoFT9n9CrtJN8FPOnMUK6L58Zf3w+eYJQMuyttgf/h/stQUx6OU7R4d/4xA1j4YCFRxw2mXaYO9Tjsxsq2KB1v3TzyZKtZfYLeiNhv/rAfPs7krACs1ncNXVtS7sP3G14+Asvu6EdnlM86LThBmIeKRW8lSry5pO3IMOIzNGrqulFnuTGP9fy9cs5d58q/E4sUXoY0Liiod92+1RO8dpyn+xf9afCAei8lG6TFNPWdLzcl8WOJgZLWmRdRNhezOmSZHxnh8P/Ul2oxhrVZSYGLhvIfBVU9oY+s7lgw8FpM08RLdP3OsKigs5/uiE/56qHZHvj2YZf6mg=
-    RENOVATE_TOKEN: AgCV8DmDz1CT+wjtghW9ERy9tY/GCZfehPbd3vqikGx8tsZzxEoKukJzkeRJmsHqDTXylFMZHB+saYuk+vWOeMT7oGs/6wIC7eC08GN4OcBYpihrTSrzoAkp1WwLJV0KoNGbtbgoQXdlPJOWBjs6X90mrFmpwRewcaADks/uS/ONZw3MhiSbukYN3L45uL6b6gUp1Yl4nDyCyvCDoRpr1FQt2MMltyChimUtLXoMrnV3iO0oFlFMITJRjvauYrKXdD0xyWxji3Rbrowbgr/iFkz/0fTpg6AwhP/ISRWtO+NDB3kZ6/CvcK2a1phTIgf2eiHfvMQIwnpfRauyUPtNHkCInC7OOtn0eyHZmAqkSaJTN1rJN3X8lRIgjhtZr9upE6ZCLK5kMdq87oDjtvwc0X0AyeTxV3EGXh87Zfda97KhG5LSC3uShzc8AYPA7SGxMTuoF4wON0Qa7AdAeGvtL+2GuhRkHhmyOeY4iORrVo8TlJsN1DsZmrbRArJWzvMcb31gefxTmg8tSZhuLOo4RHsUayCNIPmW/AvpcbGJS1pPXS8nPkDqSoeL6UW/G8CoEEisr50+9ztGOCmurobbadHcs4LhwAC2s9SuYuCTTSK4c98ke901ks4Iho8TuG3WmBkgJlEsNMigMsnW6pwlx/Xnij06csRY8Xcfh77MjluQXx833oKRxffwC9NuIgXcBG0cqGraEF6RFxKlu3DsWRIElt5Rnju/WSNhDsWubKrMVtKXuYX0tTBn
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        allowedToBeCloned: "true"
-      name: renovate-env
-      namespace: renovate
-    type: Opaque
--- a/infra/base/renovate/renovate.yaml
+++ b/infra/base/renovate/renovate.yaml
@@ -1,42 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: renovate
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  labels:
-    app.kubernetes.io/name: renovate
-    app.kubernetes.io/part-of: platform
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  sources:
-  - repoURL: ghcr.io/renovatebot/charts
-    chart: renovate
-    targetRevision: "46.109.0"
-    helm:
-      releaseName: renovate
-      valueFiles:
-      - $values/infra/values/base/renovate-values.yaml
-
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    targetRevision: HEAD
-    ref: values
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: renovate
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Danijel Simeunovic	ac0f464b2a	fixes	2026-03-19 15:42:41 +01:00
Danijel Simeunovic	a681a9ae81	multi cluster	2026-03-18 22:28:38 +01:00