diff --git a/.github/workflows/chart.yaml b/.github/workflows/chart.yaml
index 21a9a4142e..35522057aa 100644
--- a/.github/workflows/chart.yaml
+++ b/.github/workflows/chart.yaml
@@ -31,6 +31,8 @@ jobs:
           helm repo add fluxcd-community https://fluxcd-community.github.io/helm-charts
           helm repo add dexidp https://charts.dexidp.io
           helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add plural https://pluralsh.github.io/module-library
+          helm repo add plural https://k8s.ory.sh/helm/charts
       - name: Run chart-releaser
         id: release
         uses: helm/chart-releaser-action@v1.5.0
diff --git a/charts/plural/.helmignore b/charts/plural/.helmignore
new file mode 100644
index 0000000000..50af031725
--- /dev/null
+++ b/charts/plural/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/plural/Chart.lock b/charts/plural/Chart.lock
new file mode 100644
index 0000000000..4a4e52fc96
--- /dev/null
+++ b/charts/plural/Chart.lock
@@ -0,0 +1,9 @@
+dependencies:
+- name: hydra
+  repository: https://k8s.ory.sh/helm/charts
+  version: 0.26.5
+- name: test-base
+  repository: https://pluralsh.github.io/module-library
+  version: 0.1.10
+digest: sha256:0b68f34a7fee38ce1d995ea285132e440a4d532ed82610a86c9dbb924dafb7e8
+generated: "2023-06-14T11:26:09.163042-04:00"
diff --git a/charts/plural/Chart.yaml b/charts/plural/Chart.yaml
new file mode 100644
index 0000000000..891e8f3c73
--- /dev/null
+++ b/charts/plural/Chart.yaml
@@ -0,0 +1,18 @@
+apiVersion: v2
+name: plural
+description: A helm chart for installing plural
+appVersion: 0.11.8
+version: 0.10.107
+dependencies:
+  - name: hydra
+    version: 0.26.5
+    repository: https://k8s.ory.sh/helm/charts
+  - name: test-base
+    version: 0.1.10
+    repository: https://pluralsh.github.io/module-library
+    condition: test-base.enabled
+maintainers:
+  - name: michaeljguarino
+    email: mjg@plural.sh
+sources:
+  - https://github.com/pluralsh/plural
diff --git a/charts/plural/README.md b/charts/plural/README.md
new file mode 100644
index 0000000000..c8978405e5
--- /dev/null
+++ b/charts/plural/README.md
@@ -0,0 +1,61 @@
+# Helm chart for installing Plural
+
+Plural is a multi-tenant kubernetes app delivery platform.  It has as subcomponents:
+
+* postgres db
+* rabbitmq cluster
+* rtc, api, and background worker deployments
+* chartmuseum
+* docker registry
+
+## Installation
+
+```
+helm repo add plural https://app.plural.sh/cm/plural
+```
+
+## Usage
+
+```
+helm upgrade --install plural plural/plural
+```
+
+## Example Configuration
+
+(It's highly recommend you utilize plural to generate the initial configuration for you based on the environment you're deploying to)
+
+```yaml
+postgresql:
+  postgresqlPassword: supercomplicatedrandombytes
+
+secrets:
+  jwt: alsosupercomplicatedrandombytes
+  erlang: stillusesupercomplicatedrandombytes
+
+ingress:
+  dns: my.forge.domain
+
+api:
+  bucket: assets-for-forge
+
+chartmuseum:
+  bucket: bucket-for-chartmuseum
+
+admin:
+  enabled: true
+  name: "Michael Guarino"
+  email: mguarino46@gmail.com
+  password: "a very strong password"
+  publisher: michaeljguarino
+  publisher_description: "A collection of my personal projects"
+```
+
+## More configuration
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| replicaCount | number of api replicas | 2 |
+| api.bucket | the bucket to use for images | forge-assets |
+| chartmuseum.bucket | the bucket for charts | forge-charts |
+| ingress.dns | the dns name to register under | forge.piazza.app |
+| ingress.enabled | whether to provision an ingress | true |
diff --git a/charts/plural/charts/hydra-0.26.5.tgz b/charts/plural/charts/hydra-0.26.5.tgz
new file mode 100644
index 0000000000..5caf2f2117
Binary files /dev/null and b/charts/plural/charts/hydra-0.26.5.tgz differ
diff --git a/charts/plural/charts/test-base-0.1.10.tgz b/charts/plural/charts/test-base-0.1.10.tgz
new file mode 100644
index 0000000000..3d969faab3
Binary files /dev/null and b/charts/plural/charts/test-base-0.1.10.tgz differ
diff --git a/charts/plural/deps.yaml b/charts/plural/deps.yaml
new file mode 100644
index 0000000000..3892e192aa
--- /dev/null
+++ b/charts/plural/deps.yaml
@@ -0,0 +1,37 @@
+apiVersion: plural.sh/v1alpha1
+kind: Dependencies
+metadata:
+  application: true
+  description: deploys plural's api and background services
+spec:
+  dependencies:
+  - type: helm
+    name: bootstrap
+    repo: bootstrap
+    version: '>= 0.5.1'
+  - type: helm
+    name: ingress-nginx
+    repo: ingress-nginx
+    version: '>= 0.1.2'
+  - type: helm
+    name: postgres
+    repo: postgres
+    version: '>= 0.1.0'
+  - type: helm
+    name: cluster-operator
+    repo: rabbitmq
+    version: '>= 0.1.11'
+  - type: helm
+    name: influx
+    repo: influx
+    version: '>= 0.1.10'
+  - type: terraform
+    name: aws
+    repo: plural
+    version: '>= 0.1.1'
+    optional: true
+  - type: terraform
+    name: gcp
+    repo: plural
+    version: '>= 0.1.0'
+    optional: true
diff --git a/charts/plural/runbooks/db-scaling-manual.xml b/charts/plural/runbooks/db-scaling-manual.xml
new file mode 100644
index 0000000000..91c281e2aa
--- /dev/null
+++ b/charts/plural/runbooks/db-scaling-manual.xml
@@ -0,0 +1,57 @@
+<root gap='medium'>
+  <box pad='small' gap='medium' direction='row' align='center'>
+    <box direction='row' align='center' gap='small'>
+      <box gap='small' align='center'>
+        <timeseries datasource="cpu" label="CPU Usage" />
+        <text size='small'>You should set a reservation to 
+          roughly correspond to 30% utilization</text>
+      </box>
+      <box gap='small' align='center'>
+        <timeseries datasource="memory" label="Memory Usage" />
+        <text size='small'>You should set a reservation to 
+          roughly correspond to 60% utilization</text>
+      </box>
+    </box>
+    <box gap='small'>
+      <box gap='xsmall'>
+        <input placeholder="250m" label='CPU Request' name='cpu'>
+          <valueFrom 
+            datasource="statefulset" 
+            doc="kubernetes.raw" 
+            path="spec.template.spec.containers[0].resources.requests.cpu" />
+        </input>
+        <input placeholder="1Gi" label='Memory Request' name='memory'>
+          <valueFrom 
+            datasource="statefulset" 
+            doc="kubernetes.raw" 
+            path="spec.template.spec.containers[0].resources.requests.memory" />
+        </input>
+      </box>
+      <box direction='row' justify='end'>
+        <button label='Scale' action='scale' primary='true' />
+      </box>
+    </box>
+  </box>
+  <box direction='row' align='center' gap='small'>
+    <box gap='small' align='center'>
+      <timeseries datasource="volume" label="Volume Usage" />
+      <text size='small'>You should resize at around 80% utilization (or based on dataset growth)</text>
+    </box>
+    <box gap='small'>
+      <input placeholder="25Gi" label='Volume Size' name='volume'>
+        <valueFrom 
+          datasource="statefulset" 
+          doc="kubernetes.raw" 
+          path="spec.volumeClaimTemplates[0].spec.resources.requests.storage" />
+      </input>
+    </box>
+  </box>
+  <box width='100%' gap='small'>
+    <text size='small'>Be sure to scale your postgres pods within your nodes capacities, listed here:</text>
+    <table width='100%' datasource='nodes' path='nodes'>
+      <tableColumn path='metadata.name' header='name' width='33%' />
+      <tableColumn path='status.capacity.cpu' header='cpu' width='33%' />
+      <tableColumn path='status.capacity.memory' header='memory' width='33%' />
+    </table>
+  </box>
+</root>
\ No newline at end of file
diff --git a/charts/plural/templates/NOTES.txt b/charts/plural/templates/NOTES.txt
new file mode 100644
index 0000000000..0fd05c1b06
--- /dev/null
+++ b/charts/plural/templates/NOTES.txt
@@ -0,0 +1,21 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "plural.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "plural.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "plural.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "plural.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl port-forward $POD_NAME 8080:80
+{{- end }}
diff --git a/charts/plural/templates/_helpers.tpl b/charts/plural/templates/_helpers.tpl
new file mode 100644
index 0000000000..0599b13896
--- /dev/null
+++ b/charts/plural/templates/_helpers.tpl
@@ -0,0 +1,102 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "plural.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "plural.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "plural.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "plural.labels" -}}
+app.kubernetes.io/name: {{ include "plural.name" . }}
+helm.sh/chart: {{ include "plural.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+
+{{- define "plural.env" -}}
+- name: HOST
+  value: {{ .Values.ingress.dns }}
+- name: NAMESPACE
+  valueFrom:
+    fieldRef:
+      fieldPath: metadata.namespace
+- name: POD_IP
+  valueFrom:
+    fieldRef:
+      fieldPath: status.podIP
+- name: POSTGRES_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.dbPasswordSecret }}
+      key: password
+- name: RABBIT_USERNAME
+  valueFrom:
+    secretKeyRef:
+      name: rabbitmq-default-user
+      key: username
+- name: RABBIT_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: rabbitmq-default-user
+      key: password
+- name: INFLUX_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: influxdb-auth
+      key: influxdb-password
+- name: RABBIT_NAMESPACE
+  value: {{ .Values.rabbitmqNamespace }}
+- name: DBHOST
+  value: plural-plural
+- name: DBSSL
+  value: 'true'
+{{ if .Values.sentryDsn }}
+- name: SENTRY_DSN
+  value: {{ .Values.sentryDsn | quote }}
+{{ end }}
+{{- end -}}
+
+{{- define "plural.image" -}}
+{{ .Values.global.registry }}/{{ .repository }}:{{ .tag }}
+{{- end -}}
+
+{{- define "plural.migration-name" -}}
+plural-migration-{{ .Values.global.tag | default .Values.image.tag | default .Chart.AppVersion | sha256sum | trunc 8 }}
+{{- end -}}
+
+
+{{- define "plural.imageTag" -}}
+{{ .Values.global.tag | default .Values.image.tag | default .Chart.AppVersion }}
+{{- end -}}
\ No newline at end of file
diff --git a/charts/plural/templates/chartmuseum.yaml b/charts/plural/templates/chartmuseum.yaml
new file mode 100644
index 0000000000..04e62b72e5
--- /dev/null
+++ b/charts/plural/templates/chartmuseum.yaml
@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: chartmuseum
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.chartmuseum.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: chartmuseum
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: chartmuseum
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: chartmuseum
+        image: "{{ .Values.chartmuseum.repository }}:{{ .Values.chartmuseum.tag }}"
+        imagePullPolicy: {{ .Values.chartmuseum.pullPolicy }}
+        env:
+        - name: PORT
+          value: '8080'
+        - name: DEPTH
+          value: '1'
+        - name: CONTEXT_PATH
+          value: '/cm'
+        {{ if eq .Values.provider "aws" }}
+        - name: STORAGE
+          value: amazon
+        {{ else }}
+        - name: STORAGE
+          value: {{ .Values.provider }}
+        {{ end }}
+        - name: STORAGE_GOOGLE_BUCKET
+          value: {{ .Values.chartmuseum.bucket }}
+        - name: STORAGE_GOOGLE_PREFIX
+          value: ""
+        - name: STORAGE_AMAZON_BUCKET
+          value: {{ .Values.chartmuseum.bucket }}
+        - name: STORAGE_AMAZON_PREFIX
+          value: ""
+        - name: STORAGE_AMAZON_REGION
+          value: {{ .Values.region }}
+        - name: AWS_SDK_LOAD_CONFIG
+          value: "1"  
+        ports:
+        - name: http
+          containerPort: 8080
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /cm/health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /cm/health
+            port: http
+        resources:
+          {{- toYaml .Values.chartmuseum.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.chartmuseum.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/plural/templates/cron.yaml b/charts/plural/templates/cron.yaml
new file mode 100644
index 0000000000..b1405ee2f3
--- /dev/null
+++ b/charts/plural/templates/cron.yaml
@@ -0,0 +1,51 @@
+{{- define "plural.envvar" -}}
+- name: {{ .name }}
+  value: {{ .value | quote }}
+{{- end -}}
+
+{{- define "plural.cron" -}}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .cronName }}
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  schedule: {{ .crontab | quote }}
+  successfulJobsHistoryLimit: 2
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          serviceAccountName: plural
+          {{- with .Values.imagePullSecrets }}
+          imagePullSecrets:
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          containers:
+          - name: cron
+            image: "{{ .Values.global.registry }}/{{ .Values.cron.repository }}:{{ include "plural.imageTag" . }}"
+            imagePullPolicy: {{ .Values.image.pullPolicy }}
+            envFrom:
+            - secretRef:
+                name: plural-env
+            env:
+            - name: CRON
+              value: {{ .cronModule }}
+            {{ include "plural.env" . | nindent 12 }}
+            {{ range .envVars }}
+              {{ include "plural.envvar" . | nindent 12 }}
+            {{ end }}
+            resources:
+              {{- toYaml .Values.cron.resources | nindent 14 }}
+{{- end -}}
+
+{{ $context := . }}
+{{ range $index, $cron := .Values.crons }}
+  {{- $args := mergeOverwrite $context $cron }}
+  {{ if $index }}
+---
+  {{ end }}
+  {{ include "plural.cron" $args | nindent 0 }}
+{{- end -}}
diff --git a/charts/plural/templates/dashboards.yaml b/charts/plural/templates/dashboards.yaml
new file mode 100644
index 0000000000..b2cefd73ab
--- /dev/null
+++ b/charts/plural/templates/dashboards.yaml
@@ -0,0 +1,101 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: Dashboard
+metadata:
+  name: {{ template "plural.fullname" $ }}-beam
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: beam
+  description: internal erlang telemetry for plural's api
+  timeslices: [30m, 1h, 2h, 1d]
+  defaultTime: 30m
+  labels:
+  - name: "service"
+    query:
+      query: erlang_vm_ets_limit{app_kubernetes_io_instance="{{ .Release.Name }}"}
+      label: app_kubernetes_io_name
+  graphs:
+  - queries:
+    - query: avg(erlang_vm_process_limit{app_kubernetes_io_name="$service"})
+      legend: process limit
+    - query: avg(erlang_vm_process_count{app_kubernetes_io_name="$service"})
+      legend: process count
+    name: Process details
+  - queries:
+    - query: avg(erlang_vm_memory_bytes_total{app_kubernetes_io_name="$service", kind="processes"})
+      legend: process memory
+    - query: avg(erlang_vm_memory_system_bytes_total{app_kubernetes_io_name="$service", usage="binary"})
+      legend: binary heap memory
+    - query: avg(erlang_vm_memory_system_bytes_total{app_kubernetes_io_name="$service", usage="code"})
+      legend: code memory
+    - query: avg(erlang_vm_memory_system_bytes_total{app_kubernetes_io_name="$service", usage="ets"})
+      legend: ets memory
+    format: bytes
+    name: VM memory
+  - queries:
+    - query: irate(erlang_vm_statistics_context_switches{app_kubernetes_io_name="$service"}[5m])
+      legend: context switches
+    - query: irate(erlang_vm_statistics_reductions_total{app_kubernetes_io_name="$service"}[5m])
+      legend: reductions
+    format: none
+    name: runtime performance
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Dashboard
+metadata:
+  name: {{ template "plural.fullname" $ }}-postgres
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: postgres
+  description: Monitoring for plural's postgres db
+  timeslices: [30m, 1h, 2h, 1d]
+  defaultTime: 30m
+  labels:
+  - name: instance
+    query:
+      query: pg_stat_database_tup_fetched{namespace="{{ .Release.Namespace }}"}
+      label: instance
+  graphs:
+  - queries:
+    - query: SUM(pg_stat_database_tup_fetched{instance=~"$instance"})
+      legend: tuples fetched
+    - query: SUM(pg_stat_database_tup_inserted{instance=~"$instance"})
+      legend: tuples inserted
+    - query: SUM(pg_stat_database_tup_updated{instance=~"$instance"})
+      legend: tuples updated
+    name: Storage Performance
+  - queries:
+    - query: pg_settings_max_connections{instance="$instance"}
+      legend: connections
+    name: Max Connections
+  - queries:
+    - query: avg(rate(process_cpu_seconds_total{instance="$instance"}[5m]) * 1000)
+      legend: seconds
+    name: CPU time
+  - queries:
+    - query: avg(rate(process_resident_memory_bytes{instance="$instance"}[5m]))
+      legend: resident mem
+    - query: avg(rate(process_virtual_memory_bytes{instance="$instance"}[5m]))
+      legend: process mem
+    format: bytes
+    name: Memory utilization
+  - queries:
+    - query: process_open_fds{instance="$instance"}
+      legend: fds
+    name: Open file descriptors
+  - queries:
+    - query: pg_settings_max_wal_size_bytes{instance="$instance"}
+      legend: WAL size
+    format: bytes
+    name: Max WAL size
+  - queries:
+    - query: irate(pg_stat_database_xact_commit{instance="$instance"}[5m])
+      legend: commits
+    - query: irate(pg_stat_database_xact_rollback{instance="$instance"}[5m])
+      legend: rollbacks
+    name: Transactions
+  - queries:
+    - query: pg_stat_database_blks_hit{instance="$instance"} / (pg_stat_database_blks_read{instance="$instance"} + pg_stat_database_blks_hit{instance="$instance"})
+      legend: hit rate
+    name: Cache hit rate
\ No newline at end of file
diff --git a/charts/plural/templates/deployment.yaml b/charts/plural/templates/deployment.yaml
new file mode 100644
index 0000000000..8b29029abf
--- /dev/null
+++ b/charts/plural/templates/deployment.yaml
@@ -0,0 +1,344 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-api
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-api
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-api
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        plural.sh/monitoring: scrape
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: {{ .Values.api.port | quote }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: api
+        image: "{{ .Values.global.registry }}/{{ .Values.image.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.api.port }}
+          protocol: TCP
+        - name: epmd
+          containerPort: 4369
+          protocol: TCP
+        - name: mcp
+          containerPort: {{ .Values.mcp.port }}
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /__traffic
+            port: http
+        resources:
+          {{- toYaml .Values.api.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.api.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-worker
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  {{ if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.worker.replicaCount }}
+  {{ end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-worker
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-worker
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: worker
+        image: "{{ .Values.global.registry }}/{{ .Values.worker.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+        {{- if .Values.worker.extraEnv }}
+        {{ .Values.worker.extraEnv | toYaml | nindent 8 }}
+        {{- end }}
+        - name: DOCKER_SCAN_POLL_INTERVAL
+          value: {{ .Values.worker.dockerScan.pollInterval | quote }}
+        - name: DOCKER_SCAN_PARALLELISM
+          value: {{ .Values.worker.dockerScan.parallelism | quote }}
+        resources:
+          {{- toYaml .Values.worker.resources | nindent 12 }}
+      {{- with .Values.worker.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.worker.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.worker.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-rtc
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.rtc.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-rtc
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-rtc
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        plural.sh/monitoring: scrape
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: {{ .Values.api.port | quote }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: rtc
+        image: "{{ .Values.global.registry }}/{{ .Values.rtc.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.api.port }}
+          protocol: TCP
+        - name: epmd
+          containerPort: 4369
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /__traffic
+            port: http
+        resources:
+          {{- toYaml .Values.rtc.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.rtc.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-www
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.www.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-www
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-www
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: www
+        image: "{{ .Values.global.registry }}/{{ .Values.www.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.www.port }}
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /
+            port: http
+        resources:
+          {{- toYaml .Values.www.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.www.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-mcp
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-mcp
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-mcp
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        plural.sh/monitoring: scrape
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: {{ .Values.api.port | quote }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: api
+        image: "{{ .Values.global.registry }}/{{ .Values.image.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        - name: PLRL_IGNORE_CLUSTER
+          value: "true"
+        {{ include "plural.env" . | nindent 8 }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.api.port }}
+          protocol: TCP
+        - name: epmd
+          containerPort: 4369
+          protocol: TCP
+        - name: mcp
+          containerPort: {{ .Values.mcp.port }}
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /__traffic
+            port: http
+        resources:
+          {{- toYaml .Values.api.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.api.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
\ No newline at end of file
diff --git a/charts/plural/templates/hpa.yaml b/charts/plural/templates/hpa.yaml
new file mode 100644
index 0000000000..d3190616b0
--- /dev/null
+++ b/charts/plural/templates/hpa.yaml
@@ -0,0 +1,20 @@
+{{ if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: worker-autoscaling
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: plural-worker
+  minReplicas: {{ .Values.worker.minReplicas }}
+  maxReplicas: {{ .Values.worker.maxReplicas }}
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 80
+{{ end }}
\ No newline at end of file
diff --git a/charts/plural/templates/hydra-postgres.yaml b/charts/plural/templates/hydra-postgres.yaml
new file mode 100644
index 0000000000..6dce55e97c
--- /dev/null
+++ b/charts/plural/templates/hydra-postgres.yaml
@@ -0,0 +1,94 @@
+apiVersion: acid.zalan.do/v1
+kind: postgresql
+metadata:
+  name: plural-hydra
+  labels:
+    app: postgres-hydra
+    db: hydra
+  {{ include "plural.labels" . | nindent 4 }}
+spec:
+  teamId: plural
+  volume:
+    size: {{ .Values.postgres.hydra.size }}
+  numberOfInstances: 2
+  {{ if .Values.postgres.hydra.resources }}
+  resources:
+  {{ mergeOverwrite .Values.postgres.default.resources .Values.postgres.hydra.resources | toYaml | nindent 4 }}
+  {{ end }}
+  users:
+    hydra:  # database owner
+    - superuser
+    - createdb
+  databases:
+    hydra: hydra  # dbname: owner
+  postgresql:
+    version: "13"
+  {{- with .Values.postgres.hydra.nodeAffinity }}
+  nodeAffinity:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.postgres.hydra.tolerations }}
+  tolerations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  sidecars:
+  - image: gcr.io/pluralsh/postgres-exporter:0.8.0
+    name: exporter
+    ports:
+    - containerPort: 9187
+      name: http-metrics
+      protocol: TCP
+    env:
+    - name: "DATA_SOURCE_URI"
+      value: "127.0.0.1:5432/hydra?sslmode=disable"
+    - name: "DATA_SOURCE_USER"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-hydra.credentials.postgresql.acid.zalan.do
+          key: username
+    - name: "DATA_SOURCE_PASS"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-hydra.credentials.postgresql.acid.zalan.do
+          key: password
+    livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+    readinessProbe:
+      livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hydra-master
+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: master
+    cluster-name: plural-hydra
\ No newline at end of file
diff --git a/charts/plural/templates/ingress.yaml b/charts/plural/templates/ingress.yaml
new file mode 100644
index 0000000000..a441a917d6
--- /dev/null
+++ b/charts/plural/templates/ingress.yaml
@@ -0,0 +1,94 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: plural
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - {{ .Values.ingress.dns }}
+    - {{ .Values.ingress.dkr_dns }}
+    secretName: plural-tls
+  rules:
+  - host: {{ .Values.ingress.dns }}
+    http:
+      paths:
+      - path: /artifacts/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /cm/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /gql
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /graphiql
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /auth/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /api/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /webhooks/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /socket.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-rtc
+            port:
+              name: http
+      - pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-www
+            port:
+              name: http
+  - host: {{ .Values.ingress.dkr_dns }}
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-registry
+            port:
+              name: http
+{{- end }}
diff --git a/charts/plural/templates/logtails.yaml b/charts/plural/templates/logtails.yaml
new file mode 100644
index 0000000000..6e161ef23f
--- /dev/null
+++ b/charts/plural/templates/logtails.yaml
@@ -0,0 +1,27 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: LogFilter
+metadata:
+  name: dns-creates
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: dns entry creates
+  description: stream of calls to create dns entries
+  query: Attempted to create record
+  labels:
+  - name: job
+    value: plural/plural-api
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: LogFilter
+metadata:
+  name: dns-deletes
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: dns entry deletes
+  description: stream of calls to remove dns entries
+  query: Attempted to delete record
+  labels:
+  - name: job
+    value: plural/plural-api
\ No newline at end of file
diff --git a/charts/plural/templates/migration.yaml b/charts/plural/templates/migration.yaml
new file mode 100644
index 0000000000..1d78aad26f
--- /dev/null
+++ b/charts/plural/templates/migration.yaml
@@ -0,0 +1,107 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "plural.migration-name" . }}
+  annotations:
+    platform.plural.sh/ignore: 'true'
+spec:
+  template:
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: migrator
+        image: "{{ .Values.global.registry }}/{{ .Values.image.repository }}:{{ include "plural.imageTag" . }}"
+        command: ["/opt/app/bin/plural",  "migrate"]
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        - secretRef:
+            name: plural-migration-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+      restartPolicy: Never
+  backoffLimit: 5
+{{ if .Values.scanPackages }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: scan-packages-{{ randAlphaNum 4 | lower }}
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  backoffLimit: 10
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: plural
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: cron
+        image: "{{ .Values.cron.image }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        - name: CRON
+          value: Task.VersionScan
+        {{ include "plural.env" . | nindent 8 }}
+        resources:
+          {{- toYaml .Values.cron.resources | nindent 10 }}
+{{ end }}
+{{ if .Values.createHydraDb }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-hydra-db
+spec:
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: plural
+      containers:
+      - name: createdb
+        image: postgres:14
+        command: 
+        - "/bin/sh"
+        - "-c"
+        - |
+          psql "$POSTGRES_URL" -c "CREATE DATABASE hydra"
+        envFrom:
+        - secretRef:
+            name: plural-env
+  backoffLimit: 5
+{{ end }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: hydra-migration-{{ .Values.image.tag | default .Chart.AppVersion | sha256sum | trunc 8 }}
+  annotations:
+    platform.plural.sh/ignore: 'true'
+spec:
+  backoffLimit: 10
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: hydra-migration
+        image: "{{ .Values.hydra.image.repository }}:{{ .Values.hydra.image.tag }}"
+        imagePullPolicy: {{ .Values.hydra.image.pullPolicy }}
+        command: ["hydra"]
+        args: ["migrate", "sql", "-e", "--yes"]
+        env:
+        - name: DSN
+          valueFrom:
+            secretKeyRef:
+              name: plural-hydra
+              key: dsn
diff --git a/charts/plural/templates/monitor.yaml b/charts/plural/templates/monitor.yaml
new file mode 100644
index 0000000000..c944198acb
--- /dev/null
+++ b/charts/plural/templates/monitor.yaml
@@ -0,0 +1,20 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "plural.fullname" . }}
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  podMetricsEndpoints:
+  - port: http
+    path: '/metrics'
+  namespaceSelector:
+    matchNames:
+    - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      plural.sh/monitoring: scrape
+  podTargetLabels:
+    - app.kubernetes.io/name
+    - app.kubernetes.io/instance
\ No newline at end of file
diff --git a/charts/plural/templates/namespace.yaml b/charts/plural/templates/namespace.yaml
new file mode 100644
index 0000000000..186d355687
--- /dev/null
+++ b/charts/plural/templates/namespace.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: plrl-shell
+  labels:
+    app.kubernetes.io/managed-by: plural
+    app.plural.sh/name: plural
\ No newline at end of file
diff --git a/charts/plural/templates/networkpolicy.yaml b/charts/plural/templates/networkpolicy.yaml
new file mode 100644
index 0000000000..d271814fdd
--- /dev/null
+++ b/charts/plural/templates/networkpolicy.yaml
@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: shell-network-policy
+  namespace: plrl-shell
+spec:
+  podSelector:
+    matchLabels:
+      app.plural.sh/type: shell
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          "kubernetes.io/metadata.name": {{ .Release.Namespace }}
+    ports:
+    - protocol: TCP
+      port: 8080
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+      namespaceSelector:
+        matchLabels:
+          "kubernetes.io/metadata.name": kube-system
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 169.254.0.0/16
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
\ No newline at end of file
diff --git a/charts/plural/templates/postgres.yaml b/charts/plural/templates/postgres.yaml
new file mode 100644
index 0000000000..45ff4b28bd
--- /dev/null
+++ b/charts/plural/templates/postgres.yaml
@@ -0,0 +1,141 @@
+apiVersion: acid.zalan.do/v1
+kind: postgresql
+metadata:
+  name: plural-plural
+  labels:
+    app: postgres
+    db: plural
+  {{ include "plural.labels" . | nindent 4 }}
+spec:
+  teamId: plural
+  volume:
+    size: {{ .Values.postgres.plural.size }}
+  numberOfInstances: 2
+  {{ if .Values.postgres.plural.resources }}
+  resources:
+  {{ mergeOverwrite .Values.postgres.default.resources .Values.postgres.plural.resources | toYaml | nindent 4 }}
+  {{ end }}
+  users:
+    plural:  # database owner
+    - superuser
+    - createdb
+  databases:
+    plural: plural  # dbname: owner
+  postgresql:
+    version: "13"
+    parameters:
+      max_connections: '101'
+  {{- with .Values.postgres.plural.nodeAffinity }}
+  nodeAffinity:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.postgres.plural.tolerations }}
+  tolerations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  sidecars:
+  - image: gcr.io/pluralsh/postgres-exporter:0.8.0
+    name: exporter
+    ports:
+    - containerPort: 9187
+      name: http-metrics
+      protocol: TCP
+    env:
+    - name: "DATA_SOURCE_URI"
+      value: "127.0.0.1:5432/plural?sslmode=disable"
+    - name: "DATA_SOURCE_USER"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-plural.credentials.postgresql.acid.zalan.do
+          key: username
+    - name: "DATA_SOURCE_PASS"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-plural.credentials.postgresql.acid.zalan.do
+          key: password
+    livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+    readinessProbe:
+      livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-master
+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: master
+    cluster-name: plural-plural
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-master-scrape
+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9187"
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: master
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-replica
+  labels:
+    spilo-role: replica
+    {{ include "plural.labels" . | nindent 4 }}
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9187"
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: replica
+    cluster-name: plural-plural
diff --git a/charts/plural/templates/prometheusrule.yaml b/charts/plural/templates/prometheusrule.yaml
new file mode 100644
index 0000000000..ad9006fbee
--- /dev/null
+++ b/charts/plural/templates/prometheusrule.yaml
@@ -0,0 +1,118 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: plural-uptime-rules
+spec:
+  groups:
+  - name: plural
+    rules:
+    - alert: PluralDBUp
+      expr: sum(up{namespace="plural", pod=~"plural-plural-[0-9]*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural db replicas are up
+        description: Validate there are not any issues in the cluster or database configuration
+    - alert: PluralHydraDBUp
+      expr: sum(up{namespace="plural", pod=~"plural-hydra-[0-9]*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural hydra db replicas are up
+        description: Validate there are not any issues in the cluster or database configuration
+    - alert: PluralAPIUp
+      expr: sum(up{namespace="plural", pod=~"plural-api-.*-.*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural api replicas are up
+        description: validate no code changes are infrastructure issues are causing unavailability
+    - alert: PluralRtcUp
+      expr: sum(up{namespace="plural", pod=~"plural-rtc-.*-.*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural rtc replicas are up
+        description: validate no code changes are infrastructure issues are causing unavailability
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  creationTimestamp: null
+  labels:
+    prometheus: example
+    role: alert-rules
+  name: plural-rules
+spec:
+  groups:
+  - name: plural
+    rules:
+    - alert: PluralHydraCPU
+      expr: |
+        (
+          sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"}[5m])) 
+          / sum(kube_pod_container_resource_requests{endpoint="http",namespace="{{ .Release.Namespace }}", pod=~"plural-hydra-[0-9]+", resource="cpu"})
+        )  > 0.6
+      for: 5m
+      labels:
+        severity: warning
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural hydra dbs's cpu has gotten too high
+        description: the cpu utilization of your plural hydra is higher than recommended
+    - alert: PluralHydraMEM
+      expr: |
+        (
+          sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"})
+          / sum(kube_pod_container_resource_requests{endpoint="http",resource="memory",namespace="{{ .Release.Namespace }}", pod=~"plural-hydra-[0-9]+"})
+        )  > 1
+      for: 5m
+      labels:
+        severity: warning
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural hydra db's memory has gotten too high
+        description: the memory utilization of your plural hydra db is higher than recommended
+    - alert: PluralDbCPU
+      expr: |
+        (
+          sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"}[5m])) 
+          / sum(kube_pod_container_resource_requests{endpoint="http",namespace="{{ .Release.Namespace }}", pod=~"plural-plural-[0-9]+", resource="cpu"})
+        )  > 0.6
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural's postgres cpu has gotten too high
+        description: the cpu utilization of your plural deployment's postgres db is higher than recommended
+    - alert: PluralDbMEM
+      expr: |
+        (
+          sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"})
+          / sum(kube_pod_container_resource_requests{endpoint="http",resource="memory",namespace="{{ .Release.Namespace }}", pod=~"plural-plural-[0-9]+"})
+        )  > 1
+      for: 5m
+      labels:
+        severity: warning
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural postgres memory has gotten too high
+        description: the memory utilization of your plural deployment's postgres db is higher than recommended
+    - alert: PluralShellHangs
+      expr: sum(kube_pod_status_phase{phase="Pending",namespace="plrl-shell"}) > 0
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: count of hanging shell pods
+        description: if shells aren't starting there's probably something critical failing, ie a misconfigured docker image
diff --git a/charts/plural/templates/proxies.yaml b/charts/plural/templates/proxies.yaml
new file mode 100644
index 0000000000..7b7fe17427
--- /dev/null
+++ b/charts/plural/templates/proxies.yaml
@@ -0,0 +1,87 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: dbsh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: statefulset/plural-plural
+  shConfig:
+    command: "/bin/bash"
+    args: []
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: db
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: db
+  target: service/plural-master
+  credentials:
+    secret: plural.plural-plural.credentials.postgresql.acid.zalan.do
+    key: password
+    user: plural
+  dbConfig:
+    name: plural
+    engine: postgres
+    port: 5432
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: hydradb
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: db
+  target: service/plural-hydra
+  credentials:
+    secret: hydra.plural-hydra.credentials.postgresql.acid.zalan.do
+    key: password
+    user: hydra
+  dbConfig:
+    name: hydra
+    engine: postgres
+    port: 5432
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: sh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: deployment/plural-api
+  shConfig:
+    command: /opt/app/bin/plural
+    args: [remote_console]
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: rtcsh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: deployment/plural-rtc
+  shConfig:
+    command: /opt/app/bin/rtc
+    args: [remote_console]
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: worker-sh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: deployment/plural-worker
+  shConfig:
+    command: /opt/app/bin/worker
+    args: [remote_console]
\ No newline at end of file
diff --git a/charts/plural/templates/rbac.yaml b/charts/plural/templates/rbac.yaml
new file mode 100644
index 0000000000..279d6f6d4b
--- /dev/null
+++ b/charts/plural/templates/rbac.yaml
@@ -0,0 +1,65 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: plural-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["endpoints", "pods"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["batch", "extensions"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: plural-shell-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["pods", "pods/exec", "pods/status"]
+  verbs: ["*"]
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: plural
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+  annotations:
+  {{ toYaml .Values.rbac.serviceAccountAnnotations | nindent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: plural-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: plural
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: plural-role
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: plural-shell-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: plural
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: plural-shell-role
\ No newline at end of file
diff --git a/charts/plural/templates/registry-config.yaml b/charts/plural/templates/registry-config.yaml
new file mode 100644
index 0000000000..a93c07fb8a
--- /dev/null
+++ b/charts/plural/templates/registry-config.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plural-registry-config
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+data:
+  config.yml: |-
+{{ toYaml .Values.registry.configData | indent 4 }}
+  cert.pem: {{ .Values.secrets.jwt_cert | quote }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plural-registry-aws-config
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+data:
+  config: >-
+    [default]
+    region=us-east-2
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-registry-secret
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if .Values.registry.secrets.haSharedSecret }}
+  haSharedSecret: {{ .Values.registry.secrets.haSharedSecret | b64enc | quote }}
+  {{- else }}
+  haSharedSecret: {{ randAlphaNum 16 | b64enc | quote }}
+  {{- end }}
\ No newline at end of file
diff --git a/charts/plural/templates/registry.yaml b/charts/plural/templates/registry.yaml
new file mode 100644
index 0000000000..26980be573
--- /dev/null
+++ b/charts/plural/templates/registry.yaml
@@ -0,0 +1,111 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-registry
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-registry
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  replicas: {{ .Values.registry.replicaCount }}
+{{- if .Values.registry.updateStrategy }}
+  strategy:
+{{ toYaml .Values.registry.updateStrategy | indent 4 }}
+{{- end }}
+  minReadySeconds: 5
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-registry
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/registry-config.yaml") . | sha256sum }}
+{{- if $.Values.registry.podAnnotations }}
+{{ toYaml $.Values.registry.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      serviceAccountName: plural
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+      {{- end }}
+{{- if .Values.registry.priorityClassName }}
+      priorityClassName: "{{ .Values.registry.priorityClassName }}"
+{{- end }}
+{{- if .Values.registry.securityContext.enabled }}
+      securityContext:
+        fsGroup: {{ .Values.registry.securityContext.fsGroup }}
+        runAsUser: {{ .Values.registry.securityContext.runAsUser }}
+{{- end }}
+      containers:
+        - name: registry
+          image: "{{ .Values.registry.image.repository }}:{{ .Values.registry.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+          - /bin/registry
+          - serve
+          - /etc/docker/registry/config.yml
+          {{- with .Values.registry.resources }}
+          resources:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+          - containerPort: 5000
+            name: http
+            protocol: TCP
+          livenessProbe:
+            httpGet:
+{{- if .Values.tlsSecretName }}
+              scheme: HTTPS
+{{- end }}
+              path: /
+              port: 5000
+          readinessProbe:
+            httpGet:
+{{- if .Values.tlsSecretName }}
+              scheme: HTTPS
+{{- end }}
+              path: /
+              port: 5000
+          env:
+          - name: AWS_SDK_LOAD_CONFIG
+            value: "1"
+          - name: REGISTRY_HTTP_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: plural-registry-secret
+                key: haSharedSecret
+{{- if .Values.registry.persistence.deleteEnabled }}
+          - name: REGISTRY_STORAGE_DELETE_ENABLED
+            value: "true"
+{{- end }}
+          volumeMounts:
+          - name: plural-registry-config
+            mountPath: "/etc/docker/registry"
+          - name: plural-registry-aws-config
+            mountPath: "/root/.aws"
+{{- if .Values.registry.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.registry.nodeSelector | indent 8 }}
+{{- end }}
+      {{- with .Values.registry.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.registry.tolerations | indent 8 }}
+{{- end }}
+      {{- with .Values.registry.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      - name: plural-registry-config
+        configMap:
+          name: plural-registry-config
+      - name: plural-registry-aws-config
+        configMap:
+          name: plural-registry-aws-config
\ No newline at end of file
diff --git a/charts/plural/templates/runbooks.yaml b/charts/plural/templates/runbooks.yaml
new file mode 100644
index 0000000000..da8315dcd8
--- /dev/null
+++ b/charts/plural/templates/runbooks.yaml
@@ -0,0 +1,139 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: Runbook
+metadata:
+  name: db-scaling
+  labels:
+    platform.plural.sh/pinned: 'true'
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: Postgres Scaling
+  description: overview of how to accurately scale plural's postgres instance
+  alerts:
+  - name: PluralDbCPU
+  - name: PluralDbMEM
+  display: |-
+{{ .Files.Get "runbooks/db-scaling-manual.xml" | indent 4 }}
+  datasources:
+  - name: cpu
+    type: prometheus
+    prometheus:
+      format: cpu
+      legend: $pod
+      query: sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"}[5m])) by (pod)
+  - name: memory
+    type: prometheus
+    prometheus:
+      format: memory
+      legend: $pod
+      query: sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"}) by (pod)
+  - name: volume
+    type: prometheus
+    prometheus:
+      format: none
+      legend: $persistentvolumeclaim
+      query: (kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-plural-.*"} - kubelet_volume_stats_available_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-plural-.*"}) / kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-plural-.*"}
+  - name: statefulset
+    type: kubernetes
+    kubernetes:
+      resource: statefulset
+      name: plural-plural
+  - name: nodes
+    type: nodes
+  actions:
+  - name: scale
+    action: config
+    redirectTo: '/'
+    configuration:
+      updates:
+      - path: 
+        - plural
+        - postgres
+        - plural
+        - resources
+        - requests
+        - cpu
+        valueFrom: cpu
+      - path:
+        - plural
+        - postgres
+        - plural
+        - resources
+        - requests
+        - memory
+        valueFrom: memory
+      - path:
+        - plural
+        - postgres
+        - plural
+        - size
+        valueFrom: volume
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Runbook
+metadata:
+  name: hydra-db-scaling
+  labels:
+    platform.plural.sh/pinned: 'true'
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: Hydra Postgres Scaling
+  description: overview of how to accurately scale hydra's postgres instance
+  alerts:
+  - name: PluralHydraCPU
+  - name: PluralHydraMEM
+  display: |-
+{{ .Files.Get "runbooks/db-scaling-manual.xml" | indent 4 }}
+  datasources:
+  - name: cpu
+    type: prometheus
+    prometheus:
+      format: cpu
+      legend: $pod
+      query: sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"}[5m])) by (pod)
+  - name: memory
+    type: prometheus
+    prometheus:
+      format: memory
+      legend: $pod
+      query: sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"}) by (pod)
+  - name: statefulset
+    type: kubernetes
+    kubernetes:
+      resource: statefulset
+      name: plural-hydra
+  - name: nodes
+    type: nodes
+  - name: volume
+    type: prometheus
+    prometheus:
+      format: none
+      legend: $persistentvolumeclaim
+      query: (kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-hydra-.*"} - kubelet_volume_stats_available_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-hydra-.*"}) / kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-hydra-.*"}
+  actions:
+  - name: scale
+    action: config
+    redirectTo: '/'
+    configuration:
+      updates:
+      - path: 
+        - plural
+        - postgres
+        - hydra
+        - resources
+        - requests
+        - cpu
+        valueFrom: cpu
+      - path:
+        - plural
+        - postgres
+        - hydra
+        - resources
+        - requests
+        - memory
+        valueFrom: memory
+      - path:
+        - plural
+        - postgres
+        - hydra
+        - size
+        valueFrom: volume
\ No newline at end of file
diff --git a/charts/plural/templates/secrets.yaml b/charts/plural/templates/secrets.yaml
new file mode 100644
index 0000000000..a0c017c1cb
--- /dev/null
+++ b/charts/plural/templates/secrets.yaml
@@ -0,0 +1,131 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-env
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+type: Opaque
+data:
+  AWS_REGION: {{ .Values.region | b64enc | quote }}
+  PROVIDER: {{ .Values.provider | b64enc | quote }}
+  BUCKET: {{ .Values.api.bucket | b64enc | quote }}
+  DKR_DNS: {{ .Values.ingress.dkr_dns | b64enc | quote }}
+  JWT_SECRET: {{ .Values.secrets.jwt | b64enc | quote }}
+  SECRET_KEY_BASE: {{ .Values.secrets.key_base | default (randAlphaNum 24) | b64enc | quote }}
+  ERLANG_COOKIE: {{ .Values.secrets.erlang | b64enc | quote }}
+  JWT_PRIVATE_KEY: {{ .Values.secrets.jwt_pk | b64enc | quote }}
+  JWT_CERT: {{ .Values.secrets.jwt_cert | b64enc | quote }}
+  JWT_ISS: {{ .Values.secrets.jwt_iss | b64enc | quote }}
+  JWT_AUD: {{ .Values.secrets.jwt_aud | b64enc | quote }}
+  AES_KEY: {{ .Values.secrets.aes_key | b64enc | quote }}
+  OPENAI_BEARER_TOKEN: {{ .Values.secrets.openai_token | default "" | b64enc | quote }}
+{{ if .Values.secrets.stripe_secret }}
+  STRIPE_SECRET: {{ .Values.secrets.stripe_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.stripe_webhook_secret }}
+  STRIPE_WEBHOOK_SECRET: {{ .Values.secrets.stripe_webhook_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.stripe_connect_id }}
+  STRIPE_CONNECT_ID: {{ .Values.secrets.stripe_connect_id | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.stripe_publishable_key }}
+  STRIPE_PUBLISHABLE_KEY: {{ .Values.secrets.stripe_publishable_key | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.sendgrid_secret }}
+  SENGRID_API_KEY: {{ .Values.secrets.sendgrid_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.zoom_client_id }}
+  ZOOM_CLIENT_ID: {{ .Values.secrets.zoom_client_id | b64enc | quote }}
+  ZOOM_CLIENT_SECRET: {{ .Values.secrets.zoom_client_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.cloudflare_token }}
+  CLOUDFLARE_AUTH_TOKEN: {{ .Values.secrets.cloudflare_token | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.cloudflare_zone }}
+  CLOUDFLARE_ZONE: {{ .Values.secrets.cloudflare_zone | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.zerossl_access_key }}
+  ZEROSSL_ACCESS_KEY: {{ .Values.secrets.zerossl_access_key | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.github }}
+  GITHUB_CLIENT_ID: {{ .Values.secrets.github.client_id | b64enc | quote }}
+  GITHUB_CLIENT_SECRET: {{ .Values.secrets.github.client_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.gitlab }}
+  GITLAB_CLIENT_ID: {{ .Values.secrets.gitlab.client_id | b64enc | quote }}
+  GITLAB_CLIENT_SECRET: {{ .Values.secrets.gitlab.client_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.google }}
+  GOOGLE_CLIENT_ID: {{ .Values.secrets.google.client_id | b64enc | quote }}
+  GOOGLE_CLIENT_SECRET: {{ .Values.secrets.google.client_secret | b64enc | quote }}
+{{ if .Values.secrets.google.org_id }}
+  GCP_ORG_ID: {{ .Values.secrets.google.org_id | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.google.gcp_credentials }}
+  GCP_CREDENTIALS: {{ .Values.secrets.google.gcp_credentials | b64enc | quote }}
+{{ end }}
+{{ end }}
+{{ if .Values.secrets.workos }}
+  WORKOS_CLIENT_ID: {{ .Values.secrets.workos.client_id | b64enc | quote }}
+  WORKOS_API_KEY: {{ .Values.secrets.workos.api_key | b64enc | quote }}
+{{ if .Values.secrets.workos.webhook_secret }}
+  WORKOS_WEBHOOK_SECRET: {{ .Values.secrets.workos.webhook_secret | b64enc | quote }}
+{{ end }}
+{{ end }}
+{{ if .Values.secrets.cloud_shell_img }}
+  CLOUD_SHELL_IMG: {{ .Values.secrets.cloud_shell_img | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.github_demo_token }}
+  GITHUB_DEMO_TOKEN: {{ .Values.secrets.github_demo_token | b64enc | quote }}
+{{ end }}
+{{ range $key, $value := .Values.extraSecretEnv }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.cloud }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plrl-cloud-config
+stringData:
+  cockroaches: {{ toJson .Values.secrets.cloud.cockroaches | quote }}
+{{ end }}
+{{ if .Values.admin.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-migration-env
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+type: Opaque
+data:
+  ADMIN_EMAIL: {{ .Values.admin.email | b64enc | quote }}
+  ADMIN_NAME: {{ .Values.admin.name | b64enc | quote }}
+  ADMIN_PASSWORD: {{ .Values.admin.password | b64enc | quote }}
+  PUBLISHER_NAME: {{ .Values.admin.publisher | b64enc | quote }}
+  PUBLISHER_DESCRIPTION: {{ .Values.admin.publisher_description | b64enc | quote }}
+{{ end }}
+{{ if .Values.hydraPassword }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hydra.plural-hydra.credentials.postgresql.acid.zalan.do
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+stringData:
+  username: hydra
+  password: {{ .Values.hydraPassword }}
+{{ end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-hydra
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+stringData:
+  secretsSystem: {{ .Values.hydraSecrets.system | quote }}
+  secretsCookie: {{ .Values.hydraSecrets.cookie | quote }}
+  dsn: {{ .Values.hydraSecrets.dsn | quote }}
diff --git a/charts/plural/templates/secretsyncs.yaml b/charts/plural/templates/secretsyncs.yaml
new file mode 100644
index 0000000000..35b14da2f6
--- /dev/null
+++ b/charts/plural/templates/secretsyncs.yaml
@@ -0,0 +1,15 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: SecretSync
+metadata:
+  name: rabbitmq-password
+spec:
+  name: rabbitmq-default-user
+  namespace: {{ .Values.rabbitmqNamespace }}
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: SecretSync
+metadata:
+  name: influxdb-auth 
+spec:
+  name: influxdb-auth
+  namespace: {{ .Values.influxNamespace }}
\ No newline at end of file
diff --git a/charts/plural/templates/service.yaml b/charts/plural/templates/service.yaml
new file mode 100644
index 0000000000..1b9db2aa23
--- /dev/null
+++ b/charts/plural/templates/service.yaml
@@ -0,0 +1,117 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-api
+  labels:
+    app: plural-api
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: {{ .Values.api.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  - port: 4369
+    targetPort: epmd
+    protocol: TCP
+    name: epmd
+  selector:
+    app.kubernetes.io/name: plural-api
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-mcp
+  {{ if .Values.service.mcp.annotations }}
+  annotations: {{ toYaml .Values.service.mcp.annotations | nindent 4 }}
+  {{ end }}
+  labels:
+    app: plural-mcp
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: {{ .Values.service.mcp.type }}
+  ports:
+  - port: {{ .Values.mcp.port }}
+    targetPort: mcp
+    protocol: TCP
+    name: mcp
+  selector:
+    app.kubernetes.io/name: plural-mcp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-rtc
+  labels:
+    app: plural-rtc
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: {{ .Values.api.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  - port: 4369
+    targetPort: epmd
+    protocol: TCP
+    name: epmd
+  selector:
+    app.kubernetes.io/name: plural-rtc
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: chartmuseum
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: 8080
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: chartmuseum
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-www
+  labels:
+    app: plural-www
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: {{ .Values.www.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: plural-www
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-registry
+  labels:
+    app: plural-registry
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: 5000
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: plural-registry
+    app.kubernetes.io/instance: {{ .Release.Name }}
\ No newline at end of file
diff --git a/charts/plural/values.yaml b/charts/plural/values.yaml
new file mode 100644
index 0000000000..0e1d097bf3
--- /dev/null
+++ b/charts/plural/values.yaml
@@ -0,0 +1,506 @@
+global:
+  registry: dkr.plural.sh/plural
+  tag: ~
+
+replicaCount: 3
+rabbitmqNamespace: rabbitmq
+influxNamespace: influx
+
+extraSecretEnv: {}
+
+rbac:
+  serviceAccountAnnotations: {}
+
+configOverlays: []
+
+secrets:
+  jwt: dummy
+  erlang: dummy
+  jwt_pk: dummy
+  jwt_cert: dummy
+  jwt_iss: dummy
+  jwt_aud: dummy
+  aes_key: dummy
+
+admin:
+  enabled: false
+
+postgres:
+  create: true
+  plural:
+    resources: {}
+    size: 50Gi
+    tolerations:
+    - key: plural.sh/pluralReserved
+      operator: Exists
+      effect: "NoSchedule"
+
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+  hydra:
+    resources: {}
+    size: 25Gi
+    tolerations:
+    - key: plural.sh/pluralReserved
+      operator: Exists
+      effect: "NoSchedule"
+
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+  default:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+      limits:
+        cpu: '2'
+        memory: 1Gi
+
+
+api:
+  port: 4000
+  bucket: plural-assets
+  resources: {}
+
+  topologySpreadConstraints: []
+
+mcp:
+  port: 3000
+
+image:
+  repository: plural
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  pullPolicy: IfNotPresent
+
+rtc:
+  repository: rtc
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  resources: {}
+  replicaCount: 3
+
+  topologySpreadConstraints: []
+
+worker:
+  repository: worker
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  minReplicas: 1
+  maxReplicas: 10
+  resources: {}
+  replicaCount: 3
+
+  dockerScan:
+    pollInterval: 60
+    parallelism: 1
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: plural-worker
+        app.kubernetes.io/instance: plural
+
+  nodeSelector: {}
+
+  extraEnv: []
+
+  tolerations:
+  - key: plural.sh/pluralReserved
+    operator: Exists
+    effect: "NoSchedule"
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-worker-medium
+
+ai:
+  repository: plural-ai
+  tag: ~
+  port: 8000
+  replicaCount: 2
+  resources: {}
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 50
+    cpuUtilization: 80
+
+www:
+  repository: plural-www
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  port: 8080
+  resources: {}
+  replicaCount: 3
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: plural-www
+        app.kubernetes.io/instance: plural
+
+cron:
+  repository: cron
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+
+imagePullSecrets:
+- name: plural-creds
+
+provider: aws
+region: us-east-1
+
+dbPasswordSecret: plural.plural-plural.credentials.postgresql.acid.zalan.do
+rabbitPasswordSecret: plural-rabbitmq
+
+crons:
+- cronName: plrl-login-prune
+  cronModule: Prune.Passwordless
+  crontab: "10 0 * * *"
+  envVars: []
+- cronName: plrl-prune-queues
+  cronModule: Prune.Queues
+  crontab: "15 */3 * * *"
+  envVars: []
+- cronName: plrl-stale-tests
+  cronModule: Task.StaleTests
+  crontab: "30 0 * * *"
+  envVars: []
+- cronName: plrl-prune-invites
+  cronModule: Prune.Invites
+  crontab: "45 0 * * *"
+  envVars: []
+- cronName: plrl-prune-stacks
+  cronModule: Prune.Stacks
+  crontab: "55 0 * * *"
+  envVars: []
+- cronName: plrl-prune-trials
+  cronModule: Prune.Trials
+  cronTab: "40 0 * * *"
+  envVars: []
+- cronName: plrl-prune-notifs
+  cronModule: Prune.Notifications
+  cronTab: "15 1 * * *"
+  envVars: []
+- cronName: plrl-metering
+  cronModule: Task.Metering
+  cronTab: "30 1 * * *"
+  envVars: []
+- cronName: plrl-digest
+  cronModule: Digest.Pending
+  cronTab: "0 12 * * 1"
+  envVars: []
+- cronName: plrl-prune-cloud-instances
+  cronModule: Prune.Cloud
+  cronTab: "45 1 * * *"
+  envVars: []
+
+hydraSecrets:
+  dsn: memory
+  system: dummy
+  cookie: dummy
+
+autoscaling:
+  enabled: true
+
+hydra:
+  replicaCount: 2
+
+  image:
+    repository: gcr.io/pluralsh/oryd/hydra
+    tag: v2.0.3
+  
+  secret:
+    enabled: false
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+
+  maester:
+    enabled: false
+  hydra:
+    dev: false
+    automigration:
+      enabled: false
+    config:
+      serve:
+        admin:
+          tls:
+            enabled: false
+        public:
+          tls:
+            enabled: false
+        cookies:
+          same_site_mode: None
+          secure: true
+      ttl:
+        id_token: 12h
+        access_token: 12h
+        refresh_token: 96h
+
+  pdb:
+    enabled: true
+  deployment:
+    autoscaling:
+      enabled: false
+    tolerations:
+    - key: plural.sh/pluralReserved
+      operator: Exists
+      effect: "NoSchedule"
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: DoNotSchedule
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: hydra
+          app.kubernetes.io/instance: plural
+    
+  ingress:
+    public:
+      enabled: true
+      annotations:
+        kubernetes.io/tls-acme: "true"
+        kubernetes.io/ingress.class: "nginx"
+        cert-manager.io/cluster-issuer: letsencrypt-prod
+        nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
+        nginx.ingress.kubernetes.io/use-regex: "true"
+        nginx.ingress.kubernetes.io/proxy-connect-timeout: '10'
+        nginx.ingress.kubernetes.io/proxy-read-timeout: '120'
+        nginx.ingress.kubernetes.io/proxy-send-timeout: '120'
+  
+chartmuseum:
+  resources: {}
+  replicaCount: 2
+  rbac:
+    serviceAccountAnnotations: {}
+  repository: dkr.plural.sh/plural/chartmuseum
+  tag: v0.13.2
+  bucket: plural-charts
+  pullPolicy: Always
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: chartmuseum
+        app.kubernetes.io/instance: plural
+
+registry:
+  replicaCount: 2
+  podAnnotations: {}
+  podLabels: {}
+  podDisruptionBudget: {}
+  nodeSelector: {}
+  tolerations:
+  - key: plural.sh/pluralReserved
+    operator: Exists
+    effect: "NoSchedule"
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: plural-registry
+        app.kubernetes.io/instance: plural
+
+  rbac:
+    serviceAccountAnnotations: {}
+  
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  persistence:
+    accessMode: ReadWriteOnce
+    enabled: false
+    size: 10Gi
+
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    fsGroup: 1000
+
+  secrets:
+    haSharedSecret: ""
+
+  image: 
+    repository: gcr.io/pluralsh/registry
+    tag: 2.7.2
+
+  configData:
+    version: 0.1
+    notifications:
+      endpoints:
+      - name: plural
+        url: http://plural-api:4000/dkr/callback
+        timeout: 500ms
+        threshold: 5
+        backoff: 1s
+    log:
+      fields:
+        service: registry
+    storage:
+      cache:
+        blobdescriptor: inmemory
+    prometheus:
+      enabled: true
+    auth:
+      token:
+        realm: plural.piazza.app/dkr
+        service: plural.piazza.app/dkr
+        issuer: plural.piazza.app
+        rootcertbundle: /etc/docker/registry/cert.pem
+    http:
+      addr: :5000
+      headers:
+        X-Content-Type-Options: [nosniff]
+    health:
+      storagedriver:
+        enabled: true
+        interval: 10s
+        threshold: 3
+
+postgresql:
+  image:
+    registry: gcr.io
+    repository: pluralsh/postgres
+    tag: 11.7.0-debian-10-r9
+  metrics:
+    enabled: true
+    image:
+      registry: gcr.io
+      repository: pluralsh/postgres-exporter
+      tag: 0.8.0
+    serviceMonitor:
+      enabled: true
+  postgresqlExtendedConf:
+    max_connections: 100
+  postgresqlUsername: plural
+  postgresqlDatabase: plural
+
+rabbitmqCredentials:
+  namespace: "rabbitmq"
+
+rabbitmq:
+  metrics:
+    enabled: true
+
+influxdb:
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 0.2
+  env:
+  - name: INFLUXDB_DB
+    value: plural
+  setDefaultUser:
+    enabled: true
+    user:
+      username: plural
+      password: null
+
+nameOverride: ""
+fullnameOverride: ""
+
+service:
+  type: ClusterIP
+  port: 80
+
+  mcp:
+    type: ClusterIP
+    annotations: {}
+
+ingress:
+  enabled: true
+  dns: app.plural.sh
+  dkr_dns: dkr.plural.sh
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/affinity: cookie
+    nginx.ingress.kubernetes.io/session-cookie-path: /socket
+    nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
+    nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
+  
+  mcp:
+    enabled: false
+    dns: mcp.plural.sh
+    annotations:
+      kubernetes.io/tls-acme: "true"
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+      nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
+
+resources: {}
+
+nodeSelector: {}
+
+tolerations:
+- key: plural.sh/pluralReserved
+  operator: Exists
+  effect: "NoSchedule"
+
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: plural.sh/scalingGroup
+          operator: In
+          values:
+          - plural-small
+
+test-base:
+  enabled: false
+  application: plural
+  testName: plural-integration
+  promoteTag: stable
\ No newline at end of file
diff --git a/charts/plural/values.yaml.tpl b/charts/plural/values.yaml.tpl
new file mode 100644
index 0000000000..de31dd6573
--- /dev/null
+++ b/charts/plural/values.yaml.tpl
@@ -0,0 +1,101 @@
+postgresql:
+  postgresqlPassword: {{ dedupe . "plural.postgresql.postgresqlPassword" (randAlphaNum 14) }}
+  postgresqlPostgresPassword: {{ dedupe . "plural.postgresql.postgresqlPostgresPassword" (randAlphaNum 14) }}
+
+influxdb:
+  setDefaultUser:
+    user:
+      password: {{ dedupe . "plural.influxdb.setDefaultUser.user.password" (randAlphaNum 26) }}
+
+provider: {{ .Provider }}
+region: {{ .Region }}
+
+rabbitmqNamespace: {{ namespace "rabbitmq" }}
+influxNamespace: {{ namespace "influx" }}
+
+rbac:
+  serviceAccountAnnotations:
+    eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-plural"
+
+registry:
+  rbac:
+    serviceAccountAnnotations:
+      eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-plural"
+  configData:
+    storage:
+      {{ if eq .Provider "google" }}
+      gcs:
+        bucket: {{ .Values.images_bucket }}
+      {{ end }}
+      {{ if eq .Provider "aws" }}
+      s3:
+        region: {{ .Region }}
+        bucket: {{ .Values.images_bucket }}
+      {{ end }}
+    auth:
+      token:
+        realm: https://{{ .Values.plural_dns }}/auth/token
+        service: {{ .Values.plural_dkr_dns }}
+        issuer: {{ .Values.plural_dns }}
+
+{{ $certificate := genCA "plural" 1886 }}
+
+secrets:
+  jwt: {{ dedupe . "plural.secrets.jwt" (randAlphaNum 14) }}
+  erlang: {{ dedupe . "plural.secrets.erlang" (randAlphaNum 14) }}
+  jwt_pk: {{ dedupe . "plural.secrets.jwt_pk" $certificate.Key | quote }}
+  jwt_cert: {{ dedupe . "plural.secrets.jwt_cert" $certificate.Cert | quote }}
+  jwt_aud: {{ .Values.plural_dkr_dns }}
+  jwt_iss: {{ .Values.plural_dns }}
+  aes_key: {{ dedupe . "plural.secrets.aes_key" genAESKey }}
+
+admin:
+  enabled: true
+  name: {{ .Values.admin_name }}
+  email: {{ .Values.admin_email }}
+  password: {{ dedupe . "plural.admin.password" (randAlphaNum 14) }}
+  publisher: {{ .Values.publisher }}
+  publisher_description: {{ .Values.publisher_description }}
+
+ingress:
+  dns: {{ .Values.plural_dns }}
+  dkr_dns: {{ .Values.plural_dkr_dns }}
+
+api:
+  bucket: {{ .Values.assets_bucket }}
+
+chartmuseum:
+  bucket: {{ .Values.chartmuseum_bucket }}
+  rbac:
+    serviceAccountAnnotations:
+      eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-plural"
+
+{{ $hydraPassword := dedupe . "plural.hydraPassword" (randAlphaNum 20) }}
+{{ $hydraHost := default "hydra.plural.sh" .Values.hydra_host }}
+hydraPassword: {{ $hydraPassword }}
+hydraSecrets:
+  system: {{ dedupe . "plural.hydraSecrets.system" (randAlphaNum 20) }}
+  cookie: {{ dedupe . "plural.hydraSecrets.cookie" (randAlphaNum 20) }}
+  dsn: "postgres://hydra:{{ $hydraPassword }}@plural-hydra:5432/hydra"
+
+hydra:
+  hydra:
+    config:
+      urls:
+        self:
+          issuer: https://{{ $hydraHost }}/
+        login: https://{{ .Values.plural_dns }}/login
+        consent: https://{{ .Values.plural_dns }}/oauth/consent
+  ingress:
+    public:
+      hosts:
+      - host: {{ $hydraHost }}
+        paths:
+        - path: /*
+          pathType: ImplementationSpecific
+      tls:
+      - hosts:
+        - {{ $hydraHost }}
+        secretName: hydra-tls
+      
+license: {{ .License | quote }}