From d042543f99efc915a453f03e723807b78ee45120 Mon Sep 17 00:00:00 2001
From: michaeljguarino <mjg@plural.sh>
Date: Wed, 8 Apr 2026 23:18:40 -0400
Subject: [PATCH 1/2] Add plural chart to main repo

---
 charts/plural/.helmignore                    |  22 +
 charts/plural/Chart.lock                     |   9 +
 charts/plural/Chart.yaml                     |  18 +
 charts/plural/README.md                      |  61 +++
 charts/plural/charts/hydra-0.26.5.tgz        | Bin 0 -> 20571 bytes
 charts/plural/charts/test-base-0.1.10.tgz    | Bin 0 -> 1702 bytes
 charts/plural/deps.yaml                      |  37 ++
 charts/plural/runbooks/db-scaling-manual.xml |  57 +++
 charts/plural/templates/NOTES.txt            |  21 +
 charts/plural/templates/_helpers.tpl         | 102 ++++
 charts/plural/templates/chartmuseum.yaml     |  83 +++
 charts/plural/templates/cron.yaml            |  51 ++
 charts/plural/templates/dashboards.yaml      | 101 ++++
 charts/plural/templates/deployment.yaml      | 344 +++++++++++++
 charts/plural/templates/hpa.yaml             |  20 +
 charts/plural/templates/hydra-postgres.yaml  |  94 ++++
 charts/plural/templates/ingress.yaml         |  94 ++++
 charts/plural/templates/logtails.yaml        |  27 +
 charts/plural/templates/migration.yaml       | 107 ++++
 charts/plural/templates/monitor.yaml         |  20 +
 charts/plural/templates/namespace.yaml       |   7 +
 charts/plural/templates/networkpolicy.yaml   |  35 ++
 charts/plural/templates/postgres.yaml        | 141 ++++++
 charts/plural/templates/prometheusrule.yaml  | 118 +++++
 charts/plural/templates/proxies.yaml         |  87 ++++
 charts/plural/templates/rbac.yaml            |  65 +++
 charts/plural/templates/registry-config.yaml |  35 ++
 charts/plural/templates/registry.yaml        | 111 ++++
 charts/plural/templates/runbooks.yaml        | 139 +++++
 charts/plural/templates/secrets.yaml         | 131 +++++
 charts/plural/templates/secretsyncs.yaml     |  15 +
 charts/plural/templates/service.yaml         | 117 +++++
 charts/plural/values.yaml                    | 506 +++++++++++++++++++
 charts/plural/values.yaml.tpl                | 101 ++++
 34 files changed, 2876 insertions(+)
 create mode 100644 charts/plural/.helmignore
 create mode 100644 charts/plural/Chart.lock
 create mode 100644 charts/plural/Chart.yaml
 create mode 100644 charts/plural/README.md
 create mode 100644 charts/plural/charts/hydra-0.26.5.tgz
 create mode 100644 charts/plural/charts/test-base-0.1.10.tgz
 create mode 100644 charts/plural/deps.yaml
 create mode 100644 charts/plural/runbooks/db-scaling-manual.xml
 create mode 100644 charts/plural/templates/NOTES.txt
 create mode 100644 charts/plural/templates/_helpers.tpl
 create mode 100644 charts/plural/templates/chartmuseum.yaml
 create mode 100644 charts/plural/templates/cron.yaml
 create mode 100644 charts/plural/templates/dashboards.yaml
 create mode 100644 charts/plural/templates/deployment.yaml
 create mode 100644 charts/plural/templates/hpa.yaml
 create mode 100644 charts/plural/templates/hydra-postgres.yaml
 create mode 100644 charts/plural/templates/ingress.yaml
 create mode 100644 charts/plural/templates/logtails.yaml
 create mode 100644 charts/plural/templates/migration.yaml
 create mode 100644 charts/plural/templates/monitor.yaml
 create mode 100644 charts/plural/templates/namespace.yaml
 create mode 100644 charts/plural/templates/networkpolicy.yaml
 create mode 100644 charts/plural/templates/postgres.yaml
 create mode 100644 charts/plural/templates/prometheusrule.yaml
 create mode 100644 charts/plural/templates/proxies.yaml
 create mode 100644 charts/plural/templates/rbac.yaml
 create mode 100644 charts/plural/templates/registry-config.yaml
 create mode 100644 charts/plural/templates/registry.yaml
 create mode 100644 charts/plural/templates/runbooks.yaml
 create mode 100644 charts/plural/templates/secrets.yaml
 create mode 100644 charts/plural/templates/secretsyncs.yaml
 create mode 100644 charts/plural/templates/service.yaml
 create mode 100644 charts/plural/values.yaml
 create mode 100644 charts/plural/values.yaml.tpl

diff --git a/charts/plural/.helmignore b/charts/plural/.helmignore
new file mode 100644
index 0000000000..50af031725
--- /dev/null
+++ b/charts/plural/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/plural/Chart.lock b/charts/plural/Chart.lock
new file mode 100644
index 0000000000..4a4e52fc96
--- /dev/null
+++ b/charts/plural/Chart.lock
@@ -0,0 +1,9 @@
+dependencies:
+- name: hydra
+  repository: https://k8s.ory.sh/helm/charts
+  version: 0.26.5
+- name: test-base
+  repository: https://pluralsh.github.io/module-library
+  version: 0.1.10
+digest: sha256:0b68f34a7fee38ce1d995ea285132e440a4d532ed82610a86c9dbb924dafb7e8
+generated: "2023-06-14T11:26:09.163042-04:00"
diff --git a/charts/plural/Chart.yaml b/charts/plural/Chart.yaml
new file mode 100644
index 0000000000..891e8f3c73
--- /dev/null
+++ b/charts/plural/Chart.yaml
@@ -0,0 +1,18 @@
+apiVersion: v2
+name: plural
+description: A helm chart for installing plural
+appVersion: 0.11.8
+version: 0.10.107
+dependencies:
+  - name: hydra
+    version: 0.26.5
+    repository: https://k8s.ory.sh/helm/charts
+  - name: test-base
+    version: 0.1.10
+    repository: https://pluralsh.github.io/module-library
+    condition: test-base.enabled
+maintainers:
+  - name: michaeljguarino
+    email: mjg@plural.sh
+sources:
+  - https://github.com/pluralsh/plural
diff --git a/charts/plural/README.md b/charts/plural/README.md
new file mode 100644
index 0000000000..c8978405e5
--- /dev/null
+++ b/charts/plural/README.md
@@ -0,0 +1,61 @@
+# Helm chart for installing Plural
+
+Plural is a multi-tenant kubernetes app delivery platform.  It has as subcomponents:
+
+* postgres db
+* rabbitmq cluster
+* rtc, api, and background worker deployments
+* chartmuseum
+* docker registry
+
+## Installation
+
+```
+helm repo add plural https://app.plural.sh/cm/plural
+```
+
+## Usage
+
+```
+helm upgrade --install plural plural/plural
+```
+
+## Example Configuration
+
+(It's highly recommend you utilize plural to generate the initial configuration for you based on the environment you're deploying to)
+
+```yaml
+postgresql:
+  postgresqlPassword: supercomplicatedrandombytes
+
+secrets:
+  jwt: alsosupercomplicatedrandombytes
+  erlang: stillusesupercomplicatedrandombytes
+
+ingress:
+  dns: my.forge.domain
+
+api:
+  bucket: assets-for-forge
+
+chartmuseum:
+  bucket: bucket-for-chartmuseum
+
+admin:
+  enabled: true
+  name: "Michael Guarino"
+  email: mguarino46@gmail.com
+  password: "a very strong password"
+  publisher: michaeljguarino
+  publisher_description: "A collection of my personal projects"
+```
+
+## More configuration
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| replicaCount | number of api replicas | 2 |
+| api.bucket | the bucket to use for images | forge-assets |
+| chartmuseum.bucket | the bucket for charts | forge-charts |
+| ingress.dns | the dns name to register under | forge.piazza.app |
+| ingress.enabled | whether to provision an ingress | true |
diff --git a/charts/plural/charts/hydra-0.26.5.tgz b/charts/plural/charts/hydra-0.26.5.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..5caf2f21176117dafa5aefa2e37c25a1b116147a
GIT binary patch
literal 20571
zcmV)jK%u`MiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PMYacic9zC_aDlQ(!3Pco~tsXtC4xmzk%L<-|8$bR{{NJWsBT
zCehunNP+>tmO7T+Xa5~+B)E3BHai({=EN-$C=?2XLRFzqm@PsId;2p;xxavM^p{(B
z`u%=?cY9m@+wb?Q{|*MbJAWB$Z*A}FJl)+H?);@c7;X)>{sQ{9flT$u7>D#P{cE>X
z?c5*afhqn8QHDt}0`s8*)71LY@B0HML@7!_lmr;Dk>ddvVaP^6GL9ER#5kf300But
z%w<LW(nkp#M<{dvNMMZWRVYdc!<^8?2uyH<M!lZz_o}7l2A{q^-1T>y5V3&bR5i5+
zen3$S0>QsvLMRAP8j%G~rr_<-FW?6O3*ZF&n2ixl5J$|J5s3@uDI4{AXJ=<Vp$nhQ
zdJYZ*Nb`llGk=QtEE{JG(SRfzCEO24+#__+3rWCwF%&qe-;6_!gC35jy@*VSC%fUZ
z`P4Z@i!(w)Njw5GJ{yW3DN1nY1tdvO!1EX42Mz=Ix1e>3J%)meV!m)ZkpGM!PB_E~
zq7o{KA&y31hX0T1N=|V>gA)W}2Y`%5&Aqn9#$hC*ff{C0RFNR>w<_2A`Sclc_##Ck
z0Mj(W0TjdJREO|OGyVOOKeqgjNN{=^Z7h-h{jIHjP5$?X_wxTPo~m@eQAv%bi186%
zGdSGY9qoL(6ApI=-wt=Sw!ej2PX|xOeYpMY*3Mu!M!UP)PlIoFw}wyAU<h|7!yWW3
z?1#bR*<iBsv_IY&4xK4V5QQ9tBj67E!=X12|34Y@NByUx!LI-9v*GaRZhz<5|8?(0
z%!-ei|8p2+h~1U~*ggNZ`%kxr)%m}(yK_JP@8a12o(JA!@fcA+CYI6^Bk_(o6v=gb
zpJWLifq~=T7*5g10YFx@v@G$yA}a`8gj!{&mDke30f574u5IdKF9k4=W>ExE65(Ls
z0QuLU{9^=OPTmlHND)H`cbsY!h60K>Q>Y$hQFN?cjKKR}oedyYJ1OY^nIlSZh@=+u
zR{t>quB%|a5YU2#;*%_jYE@L7LlT0NVj>l_ja*SW%{5RT6Qwc+BneQ;<&O!TW>jiR
zy_AHW0pO(+p;#)rJ!d0_yB|Tu-bhiMx4W-_AO`phSsE{3h|Y0<9Q|)Tc1vqWjaqz4
zDLG$&lu+)=ffz?P5MVT*gT(8Fm<erP7B>xw0@?@|0ZubiR5>Y%0iiI;FG_RVk20~K
zygY0!EwGSZ#E%i!-rnABFDQr22k#h~WD(#5FvI}_LB=?V>m>o60L($0F=0(a5jg`8
zuwaH_1Rf!O>VubzWAa!wsFzC4)1v*C6R;o|2njfY36~9~D8Q2ifJs8Q9ALHyvLqmJ
zj6{hU(k%&_CBg|}n*fHN1O|MDVgMOPP=FYNbg>Cw5(0{1GFOBSG8!$wn8E-t04E$#
z@X%^#^w5{6*{{IoOO0-sBXKgNh%rA9tTh736es761$o3g7)aI=L+Z*x5gen)1}>it
zYJ|#Igpsb=N)sF2O^`=pswtxZ%b^t}i!p@Oo*^*B`TT%kjFYctdhFa!kNfFy)6+u_
z=pp1Yfw%w{BTjL^07}A?;6!nueksb0Ku^w$o_^O$DTxuEp^Q0>TC(${iJf5{NXQcy
zF(iJZ6wO8V1BxIQ+@PkCsOHq?k;0CWIS!HGXSIY+06ND^LQu6g0io3*>WgT0j8u!c
zAFH(Fi-syM<Hf#&rF0J0;IdaRnFb5P5QS>eiIRS)2&AR}NumWfo1w%Yg&7zlfxgDe
z2M6U2fioOMAR%0|5|a>5Fbc(hs?Sz4Mo8^TNESuG7)=O804I#YD3YZW|44NB3?)7|
znPCPPoNMW*YfdPM0Y%za6Ig{A75~5lWa*T`(8#%zB2T{&ok|eW1TilqsJ{Qy?~Aty
zIz!Y4`!Esx3Q>eO3Kid;K^ii}vNIILKAZJsgq(V32v28x1l+z``#1uwKtT6!)5fM=
z*i+4Usn$PTMITRoQyfW>ay5#SH?631icspV!r?O%oU$yo1(P1~-0>I6!AL1d$y6|b
znS?0`nFGKKve|JKACzWAMNb4;raAiGx?X5XtfL1$w-!28+=$NddMA4=Uj-#)wp}2L
zXJw&WFWe}YXM}M*3jpxspCjEbUwLpN62M5j*M$H`A)n=SRJ~M*H|w1$b|P2omvI^)
zA-ZLkj-`ypfuqsnk+Ms2X=`D%QEEg`)5fYO;OWWt#`50C;vPDOqIHi)%xO_g>=6@c
z%uSBhHCOzbUfmiNe+_*t#=0_RN%G%1W0lxyqr_4h1!$P!5;JwM5=?QKkt$-sasqIM
zqKPA`<?=*mokfw7vFn2ugaQbJJq;qvxLADQ9O6i_Btu-RAZ$~~L_H-Mb}^(qt$bM&
zO%O#%fXZgI+M=4^sUon@ZIPk1EyzIKvMfy-P*<%LvGcD`Fz*MBXp9rt^artymB)3^
z_vQb3&&sc#4*kKd{4f}nzkDmcJX4=`s~WxZZh#q_BduGcO7jWD6oG(oxd5{W2WS)M
zku*|(Ef`1fC}(dExNpDT`PVo;{}<c}e?i};(f|A_{U4b8a*hsOWJm8_K-VrjAq0#e
z1%u%h*xuO%5uqqvUIGkOC^KB4%$BPMRJ(XSUpn$dMvFlaOj&%<l233L10m#a3>gA3
zp5~kaGfwiqM{R<zG7E&zIfDx^0_YqC8AlDkeQ-z^!-Bb$({%(sk?|(L3FiAmZ|Z62
zKP#nAN=;cvYS{*o((=a0G^WS;6Bz@N0E!|c8Ya|eQ+@-~QmaehOC|J_LQa^_Glb4o
zsKx^Hb2Ncj#F<9eGFr`FN);aC2y;m&<4}`LqlD9iG#!K#kjs%h4r2b6=%Y+dv7|^v
z3xtaV#yH651EBz&OXC$Kb4*Dh7Z_7&4k?x_pv+Ze0PK@EhDoRw<PLlxon`_YGpH8G
z=PGK(PzZ41={=TE6fHHQn?TciMFuQFC<QzJW%0eDxP{~%ohsSxlz170XfD)!v?+Ce
zxmhe!I3WzeERZC$2*H2@L>0r)j@mjGpK{6lv*<(yqi6vrQY&;Qfm`c%s0JMveV56F
zm=h2oDUXDaAUQK22@5dE7zk#>_MK!5QD2F6X;Q$53Dy+6#gHfslR*7TIRi9HK(!}l
zn9o3jIgga>S0J+qSQg9#0<Up`#k%cx=p<IPc8z4?W^|FfEv1P_s4=$mz97v;V9@W!
z=0%KR=~W*LpS{MWpTA{@wO6WEDH_$%(1a8SDS*zoV#ENZQ1ZOo6jUNKq$DlYFc0j#
zdL{p&2!?NyXmLace}N;Umy^PuMYCj&y&;JxP<{Q5Au7>z@`dw|;yI4c6dkYtD#O#3
zxvBY_OJYY5Zi0eE5Fyhm$-Kvi8?(M(Z4jY3GF}y@<e6Eeo~1xKb-g!-pxH?X$ry1c
zmVr$*6U?7Ncq;oo#1sWQT38mG;vX^3W_UV76p-;J6mZdGO2XF~gssM(a|&g1mF_jT
zo*Igmd)3~rHzY(Fpq#t{0%QzN<unvroRAP5qX-3@P~GN6$9zi)fZa3hCMH}7H#6tJ
zgpiTYD)LV5Q3@BzO(dv<lDTo%q>!<~(k^(zw;jV1LSrbMH0V4<fm$4eWLN&s7jNI{
zhUM}<0{`4Qa)4^<AeooM`XQt+MjX+?0530yRi&Y#wpc6JihU{pT;8pE#~Qj;?wt7B
zsXH1ZBXANSg}XF9tv^d-DQXG+<0K^!nJ$h~A&K@$!Z?LE;TlBC$K2xfKn%~1Ptn;3
z4D`U5N<X5-DF4GRn|!~MM6WbbD|(kO$T6Epg<=GrlQ)DP2Qw6AW<gS1p0i(Wy2p?Q
zvsY@4S_VH%(@KkWm{wOg>CZ}nylhn_SsM_0K|r!ZT6${8)SP&k07ha280MLFK4D&V
z&}s96>4}U3kP35$G2`A;rd}~cn1uWapQ=?~n;^!$D2x+TgCs&xP&*uIRfj@hKGv(0
z+WwW3UG6j}gx?9lA>@YIo@l}pKyX~@bUvf1nELkwTc2QM`dAB-_DLWnrU@5I8O*np
zpa#rlB#XkbqaEnq)qSyw7afMV=&C^N@Jnf{*|_=}DoY<UQ<|burMV=b!b#9eV6_RL
z-W6jY4^09YGkX&zMgVXWrxE1H+7@%&d}8X=(JYOzL;#(0L=zZ+If=3unHAzE`Ijxd
z6u5Zd<pno#W4I6~wo4~oc*U+s0ra(KcR6H<p5DztJm_g#t7k*qu+&21dKPbA6pXy7
z`w7jifwt`g?e-DnVu}b-Q$je{-xGwHBPz`eZBk2!C$Ely4xtscwR~41lw*u2)ti(s
zKBb8L7D+!=nLM`qwFzcb66kmVthS?Rw_0Ns1zkzPayd6I*hIq8^7q5xo?i5Ys*ICq
ztEVEy$&rfVVQQTd3(tA+YD)s=kWLZbKYaI&;|TvQC(a?F0ZKTWq7iu3w~D=%mPLC>
zgRb@o2)Qywfa4fZsdwW!N)Tg*;<dtCC?6O`&rt*y$0#64$VNbU*iu9>3G<f&WiL!1
zjxvf)W)!g*i9%Jnt5rc#eD}>V4k^!4tI;})T?L$FfzWBK4}(Tjly3#ch-BP)D-mgk
z%`S8V`zK~BL#(&+bhke+>Z9P!vgAJ@rzoi~VMS;OIjmGmLCwNZBb6}u;iauvvV8Bf
z@!N%(0%jihzR}fHjG20~6cdI+6hPX9OdBFsMxvOLdGJJu!S!A#nIn2eG1nWW#&e>q
zJKz}q&a2Yg0G}^GM>}PfUa6s?rK9qEFa}$5OEwp;+0L;&0i;DK8~I6kK&57(XQ7rQ
z(qH(Aj7ODGzWO%O&6tq2{Ucc2OK;wO9^BRT^NL|BOM_Of>qGe}X633@?<X?W{LJAg
zVqz!)6rv<h0iSlybEolb+5CT2*U>r)#&wp3_T}b3%87L~&q~7}<*rpAWR0wCd0X`~
zwchAK5_9O7E03|#X3;qcYz;fecUpYk|FtA=ay>*?1KL767B;{sO4d_T1T;2-a`!W(
zL=akX4@;qpzZBolq5AN~ytf?7_l|%+pCdr;VRXict+`ZRIacgzaz+S-v<D1vxtBbK
z!6_h<iQ1i#-^D93nY<D&q*YXn2az%dP9{ROFC6p3Qv9sAY9ab5i6TTr&$86f=gCI3
zpw61kDEcLxoGLz}AY8sT%Sq)ZTj{Tn35Yr_4n}}_pmdVYauCCXoFQ6`5JQ2L%*+@9
zAFHQAJ{Ey<kgCW&sH3wJJAO(w`3uQZaHVNL?$L{dUv6RRc7hp9rfPXmD2Wz6YE*p{
zUnI(Z1UPAKSq86YVjgR4><sci%*k@ZjDA}h3FA}HORhZNbNY;VoRDZt&PRQ}?{60y
z7%DngN^2C#ql25^Y=(mwIKz<&Pfai<RD2{<_m24hP22oSy$K<X_M*JN)*|#LRGxG-
zxjg_*(LzNO2tvg$fm0b&TO6|%FwXMr1i5?hP=`n9k$mVl8xrDwLrHZIP-SaX2L6-!
zJgUSO1QCKsmdf~O4kIhPg_1J{#tZGGz=4Vw$dbf}pHHU2Jn*5yQKG48@Tn4qoC<A;
zBDELHW;kW)1j1NjB;;HwOihK}_Y_J;<}$beNtl=!V#r~}XDH#Ckom59XFEq`>wRfU
zP`Y%qb~mAj&6F<F4PWXrUC?LbOz?pU&7h%*88>0kQUgFRm;uaD9@jJ$d~l3^M{3i3
zRiG4ciqTx~9u=0L8FrO$Awn8@WEO;eKVK6lN&dUWUxMwlb#Jj+O?4HxkO@ahkmbCJ
z8K5vx-ZH(%CRT3nq&EOh#Q$8UEj+6uYG>2L_868m&I~DLTcU63R&tJImq1vh<_d<@
z?MuA|xwl;M)w{Z)`0MIqMY(9T-_+t-HQ-v|SeB6TsMal`=8Cy?BhfBtI4!(a*tieD
zaXIS71TfYkahhXss?j)hJkAOcIju1{jZrzP#pSd_=728|M+R;zk__B-EE%|^XfjZa
zCj<51Fwh)R2C7kIZB^?P3lxkPQ0*HP$bwr~0*54gjv1$ToC%itXBJM?ZlJYXq~W+x
z2Q4g?7$<usXk2cCw8hUH=10zqRr^{gphoEV&IUL#5#&X}oR9>}Cn*y8$3$fT%IC8u
z?5PQ%ac|q-?NP+|2bkiX)@*Sy6@Rjx*3tEAulVc*gd)PcfW+Q>;Lms*nWNeoxwVhQ
zmHXCqJnn~+lS6ZSQyH0(PAs4>#mQ9K^YUwcj8l1u5{~E`MgVfH%bSybg#j;NNCRH|
zGId5^x6kr(0c!h7v#<gs4PaSCx>J+T0;0>0z*Ygn9Pu+JCW|AJW`(PaGet~?3!BB!
zsVM6TH?^}|aG{})I*F%Aq;-h=yd#g868eh66@VC~D-GZ+o%-s||DeuH7^eX1eVCyr
zMU?qGy|Gjv-T6NTJHy>-{-5oqgQxfTKknlB{JHl8%yB%D?gn9?^F@lj6NU*4W@rSS
z^e!(QQOY?uPvweSaaYO3)OU0_PpsoOLBLgKi$qBmc*Qrl#``Mal=Pqa%A@1kjuUVp
zcsB{a?w0(C<Kt{H!RNsB3SdHq5Wf|6`Uoq`+n8iR-S{nokv#t@EM;}v-T4_Q=(0Q)
zZHPXI$reB{#ib9|+TM}9onRDcb4adhX7XVM9*vcA`1zY-QC1$cNm20FcV15NgBTKs
zUNe}TQv~z;q=hu^rH&)dLn&-q2y1*z1wHU2r)AX<m6vHPuoA(A#4>+8kjRg|TYXF|
zJaalIDE^TmlB%5JT6()Sf+@ubp8)q8=6%E53N+R3I$YNFyTpCgu!^aoQ{0Fll|!rf
zM3s_jPV4Z>GHz>UY+9?|I&CAk02HMW3=nYt<^uPFdxg1lkT7kvP`M1l=nO6dTk7LY
zoWkG~gybwSM{l$&ur~u<%Kd~aiSQ|k7GN*WESa;r-1bPOn_!%AaE8?T35+7;bCzbm
zBMI@4<+PM;O~^qY#<Goix^Q`JC^}hq7(T0g=;WulH2}2=?F>TVm?XwbZb4gpRam>t
zA;9hkeEuv<nkWk^Le>Wt;J1u$1e&Xx$Y2GcI=i}R8ge$Zos)W5^U`IBLT|jNAfOer
zQgySRqNYJpyLy6@TGb={z=$91_B4q|Rgruk|LuOm{_T!{`q!;jD>+laqh_K%2G)2t
z4*mCfJ4VeAmS~Ss3lD@WX%y)piiv!$46lMetumT2QtK3eYGS`uU@700kT362$+%5p
z^w|NNCjC}R57p<^wM%Ei=v=;<%B;CSRQah`PyIEiqPy!WKTG%Mmdh%{0MHb8)HqDK
z%3}jxRmm%z;v{^@fGZF8y3He9!O%d+VN5xA6rp65%8$Xost<rGKzt%N5%XzNOrsSs
za4i(_VKGn(pjYXU8LJlX;?)G=2)GA2S_gE&*2!A()9LCkHFL{N<V`ls%Y5!iZ<;qp
zbm8Gd9njR<THb_EPnv)@nR+DS9-kpkRCLNMtjLT3A*UFv#*C_LX)-QhMGd`Eyi_o0
zT2d=husS)`ort-)4U`L<q7Vjr1&NebENJjRy%P#9i7{{NB5<X!b~W^(GAF;lILcwH
zfO<wF=F4zg+C65PxK{Z_AzClYP&6?ubdFoCv^{cG6DG7!XG<|_Y)-%#VO)?8Cm}j-
zt0mJ?fWE9X<2)5|*;>FWrFq1_<t6+4SueJuUhnf~)slo%MKw1w+&pQTYpo$_&)mRX
zq$o#Y)awm~Pi2aR!AR&T&2{9){N-hDneHd1b$)bQhCDFLI7)&=yZVoUQ{Pnats14_
z7Dk4_t&(+pxh;rQJV~{_MBqhpB`r5q&_y0nGK0c)Mv3WSh!UmKOPv9o=|}}pOeLj4
zNs*v}lRRI%+zsnQ!>x|6fcFUfwqhsRNb<PUy+=G<qmK}Tcq0A9daDqeLDt+oi;=qV
zyu7r4l8IfhHky~0LQp>L5|tH>tnymMam0MF+`ht$|BU%erYEpup-d1XZG9YY;7%}Q
z+?C$NybP6LDGyFJ!GpOd>5DHGmnj&&tSUZjT1d$@=J~G=qCP{WPTrpKnCenXP4T+E
z+7wmQzBE?j{92Uq+}<tM@O5-n#qU+MAuOfy@d`j?f9x4h0q^P`?z*tbrpvmdG@C2`
zO~y;e`iYEJC2hTEg{GEE<P#aY;L%z{ZU8UJJZ>UyO--qHz+XzrChvX`s3+qpay3M4
zeJ)X2EI_{5J7}b24%RR44+!K;MV-q%Fq;>JdGtuq89eY$^d5o#Psosr>~ebr=mm@;
z_pvm`Rl0Z4*E&rqYnHa-s!NuBy%gOd=g*4x8Vz$rZ0jRfNs%L!1|{`Hx8(AHCm>7A
zIRMZ)diGI$seJr|s5<pnbzIp5YpQIh*I7tnY8#sZ>Z1fLujH1J0=SP?tR?2;V_=y`
zmg>+{!GuB~ETe-TmRfxX2n7#6k?}*@WLCoiK=-iOj<;M?eX0b&wF)d%ZgtO`EtOPV
zx7~B}=keFos|O@bNrDpYjtsT0<JL24{FmM@`?EdO{oh=od&L|@*Sr{F+5KPre)ayZ
zr#oBs_kZ2VW32|@(MrqAWAF%A7FYKQpbV4JC1V5U6er<GN5{Q}sS{fPhAJ+8nS0jL
zjHxT=V>?wTDPOB4D9SUe=moG0-H3M~b`qR~!tUBuHCH_0c}EF`4Vg6FQjbxGt{VGg
zIkswDvsTJ4&4l;Q7kgUe{|#OSwDkV3r&amCGaTOE|8pnLjf>`67s)p$0>3ozzk;Va
z{|kqaXSTtwEeMv(|LvXar&axLaDV^b-8>avQA5OpEg@i<vR*DGp69%B6%|f5Rd^)Y
z1jTCN#8PL<vZXDRUV9i#3AyeZdo{z{a(Kw21PzW@?TRSvN9!HK2K}?rvzj{E)spRN
zyh?K>z@AxY3u`G0Z-mBIp|TNL8mr1FrKp79ji7inR#=xEI>zW(6=u#BEzOweY@On|
zx%L_k)vt&`BVS$-kKz!>vdj?HE}A_@I_eb7)_wj>oYS^5P~oHEB$%C0S+Qf4;|l3m
z_{QyHVrBZZoFS_dw*^>1^1-k^G8Jyi4}n{RHKQ%Rlna}LA0?bT&>Q2VH-_@kYWuwx
zR9;+^{#F?I@_d{BJ(9bU5n}43v(IKOxUhV&uHCckGF~W|S8-B9@n-M!!SUhV{z0W-
zoy4bkEwbE}O)!7nJK6u?!;6=%I)GM4nV)oD2K&|CKM!7gI6ioFuz&LQs2Tpl&!3mY
zIbL3V*Ci7lT7c)3?1%Qyw28Y~+Qe#iT4cadhMX5EABz&rd$o3o$aVp=q~3Dz^hfZp
zwCn#j=K$!||A+nIu&V#>Y;X7P_5Ztg8Z72zTa$hf7?Kw|(7DXO=sO@Y*V0AnVq18W
zO{KP}CcZsVAwF@+*Maz0h4eU{=iQb8bL)o7dVcCZm(9@-pH>-ko$}VUROQ{%I-{+%
zklHs`SH$uynKpN1(yYiJwdLt9Es+Ne?cA+3Qk8CvVKe1+s-fs>@%mj*?RE^PT34(0
zrx#FaH>*3VVz69q^I8S4Wtl6tZjqbZJb`gtmv#D;MY_c|Us82cFRo{G-nvoTWycD*
z)*;0vv(dHMmal}QCJb{zg%vWYedcfqE~@8EOXvCAYAb?85A~L64PKgmY_?RvdqrXQ
z*A;A@Yw|5<$gQu+Rti<J!rPx#;@W1TYYq0*0NO3H7H0vZ(;C6#EsT|SFp9c*rBBJB
zdEE?lJugIacR4E3zu+~H*Ru)VD>j&{LMfqb13%+D_0-XT3UTw9awu<(v^cSHWQNYG
zhYKo@Qc5@pNHhW``-kmV$V7nGL88bcxH=9EIsID((c-Lzl;<j_uiR!gdo}^7Fes?A
zg%0tx-wWb>k1CEcV6I`EAsF#l4~mXfOI(wtqTwG93`@eaI<!C7x5XBZ@$KYCRvs?%
z``Jog7txkarKTGdRvq+m_W9Zvtv2WtAWJ)N)j<~>UHn-Fovul=>ZsQ*v{-e_?VA9u
zIN~J`_v5_^;n-RvtB!WfLoR(k`gEW?;nxsxQ9h#RmuxCfFv^4CkYN)s-W|O<{&0No
z>cxkb$H(suTD;nyKj&~-eB>=^faPY;E~ZD--pC`KK6w1N4aMijZ<?@rQMvP3J?a3$
zk7#j(CiSoFc8Yyw-mf#3cuvt`1VWaqrv9jgjt};a4o;3g9RG5Ba`5`=>4rY1aV!r4
zcVfQ(_U(@^8#hzFDCYa}&~t4lIyXfQlA2Dt@@`1$>Rd_5R|nd(IG6;C-McSs=iqK|
zf3gGanp>5{6$NYQM&|N^w$_%IT*Va>4Zec3-O{q^t?oa<<vTB&5{B})&&|enm(K-(
zl7MV=1K7t3{y;8)MkBOLl+w-KEe?eSc3Tc=38&W-oKE*e<K$SmcYAco8m#*D`Xzy^
z+bPw~dsnlLy9r$OTO|JR<R6~5KurBm`iJ=4Y|JmG$5-p)`63(ZpiKq*Pt=?W7kz#2
z^9C31#upt6P5Hi~>N3%_)KqG=EH}&WNhv0Bb&jCANv9}T`&1IU9TgkfY~y}A<#$n|
zlnC5eGAzrw+t##|GrXu^ClbHWhE1+<%fWB5kKbMgTW-;|yW4ir_SKO3(qR$*F;6xA
zXO_YnJo%%ZCGr1TgTZz+|8IY|eINgG7f<`T(h_7*il!-w^yb4c;&7-VYknXU|1MUQ
z=#Yeax)`FhFq`G!F)Q!fUNv+k4{{e6p2)k6a}}d0bVzCp)$k#(&K`5=Hs<yXSVMfP
zxUO$s-Mm8mqPVWF(zTDAF15mju=K`fBf~wJ5n}|7v<pECcH>bf76W~`xJqSdUaDqn
z<xWAfnzSu~IihfitdFY@W5up~Zp`Ah6yl!3NmjUBn%FJXiSkn|n)ph{m$Za+Sf%X_
z@hj3KNV6}%B;B1@n?v>w-`xOvtU`(#<&8$P|6oDR_fP9n)&F$HMHN7BLz>_+{jWb5
zR`kE!{$Oyg|J}t?k?JPlrW*cQPEVoAywQ38JG2}tc@;zP9MOFer;sAx{{6dwKls+`
zyTISKF1GT2%*IG-TK@N#+j-S(9V|iojL=gdolc*rR7ZnyTG?f#g_1h3g_cs~UaEdK
zhk+N}zP!vMYi>L5NIe*{G&Hpc(8eI`_L%Eh#5DlAfo4BVx%Hszt?6VUZo+%HO$e1Q
za!C!bI?4>OWiNuRt8&MdHXQ`QO<TYXk(B{OMMR}v{M{I*TKa=#5n8b)B@|U(RC_X8
zZ4FVGdNxNog?v^!R;62$-^yM@PX{mv@Zwj?Ubp;ql4pY}9`n9{&{V3$Ejot5DXJds
z%iC-f0uNS_0yV!Xv+wJ*pYADJe$+j<)wec`YSv#hrb#WH6?DX!<jB5R88uxYkJ4Ko
zkEZ<{>*c-ncK?{CP5;wDs5hbjF4g~P`9F4t{rmgB?&Q%Dn$Tr=-D`Il+$)4igy#X@
zUrZy^BlV?JLf!moI$<f3|7uEMwaV9_70L+p_4UHiy$AP-;g?km8_#N7MKjc+dZVgg
zBXUc1!{wOVD~I<_@l^FcovPUjC`r6eWPB4E;1d1s>GsZ6RsY-GzR&-ACr@RWHu=tN
z&!4S9jUf+aMFNF=N|OI3<Ex~9GdaPF_2<sAC{&ZWua-?g%m^_d%C*bUD>s-@q1xO{
z<#G#15@eL3Bv_az*cXJ3aj0+m4zsAN=2a0fh00pWCo(=MB`>h^a+T8>fQHltpdr1%
z6-KW)vTm(mv@2dc@P37cmt{e?J`#;75n8CaJT1at*m#C#eWtx}3O`td#J7fu&FDbw
z+;T{{nOtv^7Z67o?F{2>PqY9!lP#=)dq<%2O~*L5<X`~n=V55hF<>KEEF<=Fo#O=M
zBLm=C#|9b)yCzV(PRxL1r)IiXV0T3m04zH-0O}FH)n2q65CC0=1Ui7UC+q{AHdQ^%
z0Fdm`%qX>P<(NbWCRzGDg^k$~R0e^m{Mrbzk;cnfJ3_x@h_$yz_4k`=QD*dLZI8>Z
z>$E0nNgdH+`1h(@Fus@yDzf}B{=GH9p#d!K-Cqr+EV>L{<JpUql0bA)p>|f{dZ#5o
z=ZOi>eQE-%aB>1%@AL#{J3-MwqLy=sp!q~zRZ27-P;8KO?Z<e)O)PU@)#E&1ts_0v
z-Zr0X0IjDRszh8@Cs>M5<9P?rcIM&M(WxJZ0F8$tu7=2;-3M0l|B$g)9N4>y_^&~~
z|FpLM*B{>df9~XIG6h%8|9R^dN69_Lk^pSTFDisVsm!wDVNEGTYd{`9UNg<9fN<rE
zrlrbl$xAEFw<|i{$_KFT-1)Yi(@oIjmK|-PiJNk+b?5I~En$8uJ{>r%eKCM&<hBw@
zHYX}wI;^+Zy&G!lOQ*_QEgxjtCCgXI2`QQJipe0?%K>pyE}N@5Yd&8i!^4f`cj(uc
zuj1qA@Y1x*i!0@IxPhz=OS^JA866s^P_oCbZi%<q;H}nox7~eZi@RoPcL~I0Sqj<=
zqWb8S8)!_YQ*|{7A)jZ^X>g?5X$i`O+i_Wi&sWPv)ZtZaVEolG5iKKIn@8fBzK9jP
z5S{*qD<+NYCR1n1*z%axDAmA89r=`+c&RIm(r&q-m0E5~u+f}!sRO4g=G&<3D!oDT
z{E{FxgA^T75+D_SXX)!!<Bg>X_+L>LZm+5uti+<XpN+c^s&}1iM2z39Wf>X6;FL@z
zuW*ccooiAQ_;!i^1fSS{($nPsqhokOk^kyh693iTsptQAx^<ub<4&H2^{#9?`ttH|
z6-!@rNae1mvSqlES89osdV^u|4Sl-7P<ivyyS)6;V|kUQI{(w~MnXPI&(itd->v8W
zx%dCy$y1sCV)*UY&+3d%rT$s?pbts-95b4wV(R=e3#aHxS83hqMYF9{J8xrB$2+Pz
zq@a&L_D?YL)l;4SV(q`Vo4?hwWd08ayZ!3@f4hU-`}uzt&*!E0f8XSyzrqE%U-atk
zYG0)$3^P6>RHp&5ju|Q{9FYiJ@A~sq_So{XWgdVj{+^O7mCjR`rc8T3i<lbl-Yslh
z^LdWwn2kX0n~!jQ&48zF9nSv}Lj2k-RiHIAnwA>P(y*}kZH!E7k{$)vrEAI+$MT;z
z32`#LgCQjm(w<>M=nf<ulXOn<+uA6xZ2SoYT(eN){9VIAV^6VFx_a+0_-db~_5Y>~
zfTjBXu%`bHcJI&s-^tUpb#fPOfV*)4w0G+kJOO_wDOa8U`u>s|6#+};|6qHk8vl3i
z|GTTFGXK@^w;unrX1XZ1;ta2CXy10GjO9UJx}WNwy=z8)sjQoCQ}|nk97B!`@I6Wp
z6*3b73X_n;IwC;Oo6iu)7@{B~h$Rm>nBqACBtbrSCtiy`6Ocm2&Ik>`46;0rz5~kF
zBS{+8f*8y^X0nW;lDQ`3k;G>&N@ws*7K5!Jc>EY#0E&LgFhwD7Ri@7}2oS(ThE0qS
zkbx6_b-@J~?{1?cC?B*aU4hh%T_DR`3p)j3b?icxG;yg8`e>?S`FZ|8f_=rOF8}57
zc&GV4cZb#epWXhTe=q;<;;G4hJH=d=C%CHgT`3g#j&f->E&z5%uN7k4<Yo#;oRS13
zd<0A<S6P&7oNg>8IZxfw*bL8e`B*m_d-ba>%eBh)TdGXaDk)9v`r)SAf|F`4skYRH
z<qd%=d;iz<16qe09+fi@?H#_<Q-JwDKnC2H$YV%2nfd{th=>&_?#&18WALcbyVs<Y
zT;p+*m#Ph1d9rCpcRS}+;_~&TX4@1nl(Oe#7wdnnCTm@1UR^&;8cM>HnA>jbbX$!G
z=<62_tyEk~W}BVOi3Ky%Jb4V!R0&faCmhi^jJj)3n4*`uWYLm%dxB#`vPSI6)pfyT
z64zAX5!;thVx~g=V$?0`b{mE8SG053TB|l)Y|Ziuc@Nt3zdOwTIoNty_5bY-`}g|a
zojfi2UnTixhacd|%HN&k&FokabT@DLgjuDvTUYE%!pt=_J6&ywYFA22xR!2LOHKF%
zmAgNjpZ2z%s{H4OarIv>AW4FP8#o8PZ2#wJE&k)_&enbW$DKTlQvHyG4HDg5D$*-#
z<KF7|;yO0=8nDD6?9NaW`)t;m5pwE|fW(|-L4X*uQ{|P;b(kX&GXx_(lUdR{iePAN
z>(WOU#~E9U$+>=6oY;GKHbwlQIjW|Pzk&A;SF_kg%S`c}!m1|`lC3lz8L5uHn*Y8a
z2c9N`qFdmxrTf2I)%>5so#FlbzmsPJ974_!O&H(=C>8)`Gn9aFhNBQCQ;@>o6iyNI
zoegj@!wj%2l^O+LGZaN&8j-QGxNtJv1QbP(<2jOMu=O4$p|b%JG?nuZJW45=;Byoz
zUFolneegDk7JwwOra%d#h=K?w$annb#~+S4p~%?)`y`G@0)E;*1|g=*@u!&g<bM_V
zjz9jL_T+!fi`ld%{$u`R^Q2b*8pGf;OTh$3h&fMuc9uF%{4qRrp7=aYohSd#*#JL5
zib=-6%jXBo@l#4Zp@2I+4iW6Ba+G{>{5cCqh~%4d{-uX@rAN*Gql3NYuMhk<yp=Y(
z=l}NhV7t2h4|aEU?&tqqJR3lAfaCo2eXa-e{o$^^{p%y4@3T>_hvTWwW*9}G)UL-c
zoT8pC?Ww{ZP9}uLa%#iqAB-;|^xY(a++)9GkfO)nukTe3d6>$pNJYUVEr{}-ReY5;
z_R_RaXNG>?A1rC4sNkvcOIvZAJ@5mHVi3$A<zPZ6P~jy)R=z#@1^gfg3UC5`%#9Mq
zdGh235~EZo2v44X|Igrbc6R0yx)7Sk-yLUT1H6XVC>@S-0i?}x0S;n_BX9xU(Fj~P
z7r^s852%045BXj+e}Z5PF2Mgc!~aJ?{=59Ep+RsVn>?1`m0+KQ$Z;&(rkKyNvGhL^
zx=_dM|K3sH^choqI8s}+GA2}X;;6{rkoU->@V{^_JnOkA{Ud%k7g92hdOhD)ICwEc
zj3WvzK<V#CrN1773(d&7n@V{S`22_jBJvW03-DZTJBwc|pje({$kD3f<CV~LF7ixc
z-~tdCWC<?7$Iq7^!39wM%#0#=Hq<KVT<9aRF--j#WV7QeKG43F3os@`4E9G(GbF&U
zGt7gTSf3{_Vo3Z*DVhuY)}-pSHC!-8f)!)KNuk`wNGVCl6mk@b`h12!N<yYkQ5n_B
z9dLDiHFxycHHf>T&zGC7)s%WsB!F;7?|<ENwH_|N*@t4)8!Io1gk6PJ)V|zw^H5_^
zR3>%QrA#VJUCtz>c1La>Jn0R<6Y)QH)2$rVmn}vSIXk3yjw3Wh2P}Y*%4{`~<lS@w
zYr{uW2q{V3(R+9A)hqW`(F0RA%&VB=^+$y87ebLxVHYDYgqtqSl0Ei@B;sr7-8+V;
zI~w%+mz%D2mRFGRQgM(<u&%i!Q{U}DtEa(RlMOpEHrF8?BM#JP%Zfm7O@!tsD)C<v
z+)|Q|2+K=OKED68jGo|1NT->U9Dt}W8I*9kklQPpfXor4SZbx>lL;A-DL5LN)t<d|
zdSa?HKr5a5UP@;TNGuR32?1mbPZQC#M%dQ0s7%DJ86vxqq5w}8vJqpoZvrkfb@L~{
z48Sl%q0pF7z@vpF1f*&%gJ))VIzv=9-b{kFq)~Nh$b=&jsns~7Az#ySpdEu{X9=~*
z*(yZ@{GSoXSO%kL0VootJJO`#L}q^ybT(X9G$82535XD!BSm<~02Gs!1=4H?W&{UF
zvVw{H@_{m@V8jT(Nk9=~NR)(0p#BvW7R?es5`dC9rX*4GLfT6a<~%~yS&U7<vS20}
zevK1+nvIbUUQWP*WFREq3?`*MSk<yb^^;4~CPYX_F~Owe#Wn#9KV?jQj0N-r1&A?7
z7m95tipgBf+#sXT0*on?B$<d6`eAWY<e@Jh3eu0HTO`d!V9@W!a=T96KRyD3;j`Bm
z05dApg5_dOV{Y9|z&I7XxBwqZD?)jm&d3=c6OIzq0V4=70~9uk*?RJq(p3E#mzKJW
zEgV}9!Ev=i4V|`gPqa&KDfCK3oeN;!Exzi~Qq*Y?9hD2q^BhN&(J%=W<#H<8ID{0&
zh$G7KsaURG%I4D9RFSQ*N{~HD;X*84vV@qr(zP;1GMuweze;WSmazbo{UNvzou?=e
zDw}aVzIglAq?{Uof9@SM;@Fm}t*%)%RoB<QS81uV)0`_~cz%SWX~x{q)}|Zdr1*PK
z;kh3U_o^+ap?-zuC_#)JQZh!JD=IY15!qFIB}0W;a7MA9ovjvVXw6L@AsFH{+oq*D
zt2N%-`Z0%;XXzSkGpokcTCS!<D#=JG81;H#77G}Lnu!?>Q2?nWIQ&NF*O?C%tQ(pP
zP5GAA=(L!iOM6^Na8>SlM~!;n3LbJ63rrAAV5IXiRROM|-qxh4r8C)}^5koEX!WwK
z)7G7++fGhq6tNkJLU**Y=?YR}7(GW3TpXi-Bq5XUQ$#Td^EU&vSQ(Q%mEbv!<-nCu
zSfYx*=~TdLL-~~|-_00aQ}1p8dKH!10!2H->0R+ei^hMi*#Geq`}TB;ew&VMsW(zb
zX%bvjShhOu3tjwu|JU*oAr$jfAQg)HRq$xm@mEmTYJe<r;HuT-0i+9n6FGeb{eE*z
zTfbZ;G}YlzW1q;q?UC!21gK!N`e9JDy8GZ|0vL%AV3=oGmSL$BBnX8{he#=z;}9`D
z6>tDjL}SckthOki{PI@50`Ll-s=15KVVp)nCubZ+QvFq>Ng}3ulu3WHoSzUJ5@w7h
zokm#9mzRuV;)8c$(up~TCv6x4SUD)0i;pUXwRNiF@M>M;*~i+nVx!j`4F*6ndY!H4
zlfQLtQbUIk17|bD#o`5PpxKOMQ7E)M1twh5SfaKEs!H0)3`wQWI0dWCa3W-{6pTWs
zGsNYfXw)&2Sx+|sR6sBTQ++ru1Q|2#L=$(Br*W_0+N!lTEOER2`dYT>>KGHN++fq?
zDs;LixAKyAHOsulSDd6IBGbijDkRZ9Nf@UPH>tD*P@xgD)>ADQg1%L5+opkikwuZ-
zNmJvS7j^XZPF1$pR=7L*T-$vpCD&H3s>Ul{q(T6FB4bwwCzV}#^x4&C3YE+fEQaKM
zK^SA%Qc5UyN88)mJC~cTie@am-oD&)xzr7nBj^Jc0w|G~ewa`ayQBB+pzq87^`5z#
z?%?UrAMDCM2Sf4qx8m<->cy`6>*eL9n^6Ulp=cu2&dW_VM04Glin(a*KXOr_AfvTw
zRwAe9oEAr-6(gHBb+?i%ij=0S_Rn%zrN%~9FJ@!zyXU0ZY84OPZn<mP8{kR49Do=u
zq*&E<BvWT<g+`Py1U^>T?qiO03aQ#P6a2OWB^g&`qm<xC;Pea007;?(1JS(H4P_0D
zh*0;YN_|o|3lu)qBey;RoOGbpm1@0WW=lOrnilyS>ex&1!9Gj`@iJk8<HQS5iW0F<
zkqId0r$^Hf@BoVtO2N*5$vC)E3OQj*&@A%XFUPcuoI$tjoXbsd@Cf-+Uy@#JU5ASV
z#yBu%f`MGo<!D&?bzW)?DHig8J#Os)S9`-2I|^A*cch*{*$s4#f{Y^|45=|>2o#Wn
zw!rW>(rmy+;1d~dRve8#&rqV+h^Ws3cG2-O97XbAvuY+(M#v{J7U~IAA(NudSvsXK
zM1BcgsimcmW#pG0T_NBx%hzqa95IcgMLQ)xD}v<@B1?^wDFkO}tJMcDh)`>UNKtG|
zCIHSMjsyn@8graX*{0fv9|6!1XAzQssmO&MMH56(5};mvL)WIIIUwJl)hUsvzRsjs
zs(fimx756$8J9&kK$}Lp9Ra2j28b!_zWsjZU*q`vUvMk@1%01J|MRc(e_-;<IXZZe
z9ld)2T~%yC2pB^O2E#3|y|W7<LQ&lH4GcQJ4m-bYxfU%#G;cDdRG<V9Ut<!YO|9_-
zVp8HnP$JA^{Bha3mVj$FfRrZr%gGzU4=G|O;mS8CiUUzxXTG$6P&=x{0z&8_RKqPn
zSSzvwRsi5|TCS-AkSew2MW9UWDw(<uvA{RyAW<)wQpBnoq4`{_n`;qNN#d0zP*tC1
zL~fbB|15vGBLzv{4HA(6M)Lipn?gQQ1;sCS<o5K-6QzK?6l^I*M>ej_iNL-5_43z}
zRJb;R`sm5cVpvhVav~Q5uN<Rq<Ylk-95cz#a>Yw=UbzHG^<b%;{WZ{~nJl>qM#=d?
zs!B~AT!&T)Qi)nkSIRc{F`6&=ZS&i-UDCT^d40w1veKO$mwndo#0tbXj4XA7k~0Rz
z3!uzR94I$umL$fq)s2|L2&IP2Rk;P7Y)aL_!pb~XIY;596nWZ-vI)c=S|@QgOC`M!
zMTjF$2~~IGj?sir<jHSR;Sk1MrOp|`)0yDffw0=Tb~=rtsj}mxCxx{utp6(S5vgK!
z5L>=CqCQ<SrmgJpsF(jDH0`_XZn{mk@$!&dtgsYGF>T)yAszSiptg!3srLYMs>@uh
ztX_dv=D;t+a@HPQgWugkx83u86OMQLDAPl~AlG^u|Hp_Im%s_sw8eG22e_)D;oicg
zap|thtL_#HAZnk5!&Ah>zy~N4s<kvK?Oo5@-n-Vma@z$y*V#~RfHxA7*C68izICol
z{ADn??#6HVx~-M^P!tza!y3yQ*ov*(*Z4K<!FJu0x&G#B%f*yy?Yh?Qv-tX!=&t4D
ze%EJ}U7sblmVEgovF~1Cm#O`JnVZ~RYG~!_+gED8l&!%85Mo^vmgg~5`Qq$!0j_pi
zm!;MlFha=^WdNB>fL8u>{p;)|HE%EE7O0?8*)n8uDWoKd5EX>YQVD0tevvGbhE=Pi
zYUvu4G{(uE@z%Mcfm$!rr6ru=aaLSg(s0Crs({9QEn*EN<)W6wW3f<7EKg00#5*OU
zD|uAcJJTa)p5`5$GSq_k#g7YVJeCa9p%!~u88MR#ont0Dr=V;CVU?DP=q@X*&z{z;
zNn5`LVOV@Ip)m!hQ-sn+X*ot(E0NnsvUjB-keUK=$LUP@^;HsCGjN(hJ~$|oRyp@|
zPSlu$LX?KSCZv*btNH^=v$$*;TglAak=v6ndirHAr6d-TJ7aFX{?9m1^WDYm?d_d>
zJ9b|!xGxXgZs%VIHZ5&zH?>ifMuNvJ`yi)LK`-UbTc(`eIk8sjM;`E=V$1v1o*J*N
zl75}WZ*#`dx>P(!yk2N|4_n8#l%KC8*V+e69WLNABP(^0JTYKHD|LlL4t90dTkc|t
zvNAFBB#X?Ba}gL`Evc2zSddwfUnov0DWKXpm0IiL2Bh?!w_fQ4!!_bluUOwOEf};4
zLY1{ZtmfOkp=rO~Y^i#yJ5qW5(I!l*!+o6@W9RhxdYIYHWM*^o_EK)PQ>R^#opplC
zE=9P^y{b0_|CY0Hx+8bD&+^wg%ceVWx8&PAYi8~ZX*lF`m`kck0$Jnf@WGMUnI7d^
z*dYm+Pg0by8J=)?%s+QtdBTpF5E}Qk{avB)@DDJ>y&`+9_%qKYsb71=XHO-!^#T%m
z^MOC(anwM=8_=IC{cUKY)dgcTSQv&_%%BA3ZWt}*E5IpYIv^!?J2kYYnYVei{BUw|
zXxLlXo^lZ7*yCjCHv=qXZ!G~9tRqE{`3gBWo8e%VFHwaBt>A?1O_&U?r53hy3+AH|
zJgN;THDp!kXO-ba4bY2Junpl3uZ}C0nI?<Ug*9Dt{E)TS>MN?2n2FM}>W<W&{pmC2
zaYCXoIUn`?zQ65my3#-X0!MjF+#35lXL%CZAJIZJBFqDgnf8NeAGtxdZiJc}`EpE}
zY%Q&N$TBFD2{ShJ7@Xlq832;j;-j#*WON$yWo%au@xa{s(u)_K`q`ThQbOP>_0Kk-
zcTFE{6U3|dX$_nbAJk$+Y?crJWkGO?7Ai7Nj8+U2I2Bc_WH_P;$6M=h_A*Wi|I~yM
zlfxz-1?97PFDzM4h<`92_=ADpFOuk3IbRY&&j<-W_44999gN0$y58ga44Ys1qvFzJ
z?lZ-PKAYWi8_V)P_iOimYz^-3f4ZATXy4ue$_PktiY5?8j(m0QIFl?<VRV#4(c6qa
zdJH~006af9eD(I1?;bol&Bj7fgDK*A_X2nca36erv-kSo_;7Fk;L-(NB;E|fFCrEC
z#|{9drf3Nzb5ZR<UI{$-teUt4Y>@=tJ$MvCj)42OZ+`hE{wDOk`Qe+_-yFL(9D$(F
zJs5{PV{PD^OUF5zi4{~Rk^cokB2#g0fIX?Q=!k6{j=ld{X)lX7!pW)32!XVxZ4)p8
z&QKozt@CUu!(U&_pfc|hjwg#Vh&k{)rJFuKcy(}c@ZtF2)eAwFpZ8AofB5j?<tss|
z3!NDh0EHz*FjPqtKgbn5$5=lom=WN5p7(d~Kool*3gw<Y*Dk6@P&D~!@1F;+1Of;9
zCvT4~i((;3kR$)|rFruHxw}Wne|0FeoL;TBFJ9in4FJpXziw>}s`>x7w(s-5-pNzS
z|2%Y{oj*|+LBlO4Eb`)wKrQ#7mE;fyqJ+^DDLnI)wwN(Q1Cnr={z4}Ul<Hy(C8NpT
zLU!YzhvR84B2(h&i{j=}M<-pjc~f7xXX(Svyp+9i=U#}d_H@jDbztQN1i+H{zuO<w
z?tk08zyIxSo(<r6)^4`m@@7H}Dk4%GdnbGZ296`Eod`Xt*u$5nQTC4x_D&9@!G3hG
z_Z&cZ+*L+~L=iCO7POL;M=&rMY=A;AMiDvl9qp&dLn7D+y#H0VdW@54WYv|2KxBl5
z@fMmCR~j$54=QaNDX@y{4suUbn!yDy6}_XnE)T|Ss-)O5Mv~7EWe$@F<hZ>iAsQ(!
zq~oYiJ$e17=Yh9$p<)B_W03N@%*}2NkBmTZU?dlBt@X8(a{%CQYDDyoDPKFT;s8*b
zbr}Kse2b=L{lth<J!N9i{*Z*lJ)|2OxvVc=zaiy$K#~BZoRv>H^->ag27;GTgkrg{
z^c?eY-yC5W0oT>d?&ntu$e4E(XJj8dB@;y_$3DTC55uu_g4En*Q2mw?%Joet);Fcp
z2N9NmW5&U_X*o?l_VibE$W%pw4E%GM?p(n6sCNw;iVgj9>+-M>D3^4c3880@hA2Fw
zgp-lu6f<(<SQ$b_;Pa(6Wo{|YiGkjj?&SK}P7L^4%XwlNxarI%8m>-%Vp=Iuo8)gy
zhLf%SYph@9$xv3PHWbwiTbjH8CV7XHb?BU{t9R{u9tyOb<iy;D7E+R$-yYa|^-BJ3
zPD3)1_OdEqr5CBbe#a1%==asFJS}NjjHp!C2brWPxd7FDToN=aX0a7@tS7)m2ai}8
zS-ZGo;}&*Z9W|B{LPlT=Y2L?<h&mzPi$A3R&Ii8|)U86xtrmqy5$~)xqMSbM02FCV
zU43<)s8+|eJMn`=z2#%k5fH=k<5P4dlnF&1Q|U*v80CLd?sfW|BuE!Oo1x@g!XU?N
zBBT39;5m6i__59as*A~P9b5NIZGeXR0XIPR9f2xEepk8T#wndn-z*`wwDlpEs(gFG
zh!D?f*^iLlqhe57i<kMRd~r_B4Gnt%1vTuSn6V78-p<qA{=iT~trqr1hQ2T;-&H+*
z#=zd;OFhwKDtQ&BVMTU30Cb&r(Xz?3xo794s2wFqDVb6zgs!}kry$OWJS(5zIE%qV
zit8j;6g#MD*Cw==QHtcMn*=yQp}ItKkpzeGSf12p6m0wDpg$|LoTfD0j`^Vm!02Ji
zB3PX?9ILxYrBYmoU30q;0CsS!n22B67P)`!{^_v)i%a1?%utjf%6y()#TBr`{@>aj
zRssDF0`UBQ!~WCl`~9Cgc|L#cJppqZkK|^|1V@N3QuJLc$P&!Z2t4V@D-(N9oP+aJ
z+6k2-6Owm)N0;-2b%7Iemsy@#N8M-U6=kFf>nk6#Jo962H><>zbDAXq*xiypaeSOj
zCion<o?E&#SNv93?yI92FmGd$31jHD3`TNaM65k32F>{yDd@617j1~XFfc{|%otK<
zkF4N8+3ShCKt_sssrH+71T*kxtPV6ie{(F#%24bS1&@8_<s{G3B7x{QDrRTC!aPsM
zB6t3!1t#;3C~TJyxVSXVD=siMG_57#GG$r|tVH;T6_6gtPK>@=eQYf}b9yK!<tsaL
zTuX1)Mlhu~;S=C~!@O^pTY>f<Ss7;KzUEFYw1!tq9h1ugGBw1SUsNfno-G|_S=Mds
zludK>JHKd0`u1RefcrNWxF6iB%q?|cn${_oU}|n-RCfojc(-dsUdTIM&AAHM^{zUa
zHnP$cZ~WIpD{h5qhLvwN2vD^u7vQ&y@akQ&btp2f2Zi2vQO3#mq^e_}2H|_ewg0H>
z1C!pZC1X;`_SPgQWbqem(!%04byx(fSW!+yd!8%2s<W`Yo#t}w^Sim8X|-$qe(44I
zj-QqEKkIDjRd$1x?f>ldEBC(-2is5Y_kZu?@jS0|vpY;v*2^yfE}TWH-0<F@i}<Tt
z-d<ZWR=dQ#nppqU)o*b(HnG|MD&1dRItD81QZ&bcTt8sO30=sew!)IH-DzI&GpYN4
z<;IkkMleAmYoE$f%K>$|eNk&r{VJEEgZz-P?m@}LR36E7x^rV4x=NP{eprivI+*BL
z6>xq%_42kF;)<`|WbKCQm3nNSHNDGj!y9b3@Mkr&U(1-6!>R3ZI;-PQ>v{F2aA4gQ
zUZ{vwhRid&xR$i3B^SKB9MwK^I0cuNZWYp@wbxs#V<kN-;b1N(x8ntY2YS`{Yr98_
zVxFfDl6Wu->34(SQ<;);FnZR1)~}US^E;!_cQek@QLkrV*_031*piRhL_}Gk^}*wE
z-|SXXLiu-X?dhXproHX$?VT#58gG>V<cCih+Be^1>rG%Qv&g)*4fxVla8o0B2`?2z
z?4EX4UJZeUpob<b@<593I<E6yw{81^DmrC;;XZFdL45U8COn%6s{?67s@V0dl{K=W
z-jIDEi4h}%VHvQM*Y-7HOw3})XCu%H(Y$AU^dd6tuBIpc3#>QPm(j9%m0by~#+~HV
zdR@OFudVMjO4m~Xt*#$<I%kVn5IeVrS{S1%iCRheTNJGYt`sF3Vp^<*J1W))Q`+rr
zTkP7dN2;uyYprc{sb_AFEmRM)Keciz%i3tU;2>|&-W$K2M%%7Kuuy2*<Gu<)U(Wtp
z$^K8n@pZyLm&JeY_G|k;{hj;x&pUal!Ymx;hpxTLOQ-4{P+^6IgFtOW(=08vp|9g9
zFuMF7--`bHxw=9M(u)37+`3<Q{8yU)bPR)Q2!JK?e`m1uv^xKX!>#-Ie-}@6g6A{4
ztO8wQQd@diZXJw3ZQA7aftE-K;meE<fxALhXXiK~5i0dYGA_*cj8L6p*gt)yc5nvQ
z=@JzU(JWHtfCpfTzo#Ti*$BK>HTC5W?ypYSdI0ZTA`lwtC|`FIlwb7JAx2$sj_6oc
znj$WWMwrQeW$cmop>u3*0yj%T{VO#eRZ24ns)Az^UgpM*O3Q6c{@P6cf8r#>$@I>K
z!5ixaS*Akc)QB`PvDBom#Jpf5j}$j=R5)r8MrNHjNJ;4DjV)z((TgKA5qO(1>L8f|
zK%M8W#=w>WS`6jg&Y@LF)H2o9VB;kds9}zLh4Z*POkZrOtvG7`X*2Q~Q?VREvqHsE
z*o{Jb^j%YTOhGD7x0@BUcEIY!g@Ecz`#is!X<f{x+nGG2UUtlnt4xO+_KkA9#V|L=
z>E*%xDjXa4&q_~+{pZh66wAYp=z47|^Z)D&cB<!pcXpoM+kbcQY=A?^Iie~bu^Mfa
zTWy@-D3tleVQ>nki22TjI=#WNG$oWXz-B0lz%(Lb<)gvLbQ4e%L5}B0r7kJn!z6Sz
zK!T<!x7nkVq6t1nq4L81^|24$CeZ?rMAj52ffP}B9?N(9=f@w8Iibke06Gfsr~P9P
zV#*wUig{1|SE29t<KJmd{@1*iO?%=$=1(?HdIg{{3{JCD#y&IWiO<eb=ZQatr_K|f
z$Eow=|2Z4rCrIUe?=PPpFvm|R5t7{Tafo0~m80a-A5q$M%>Sc<z2~nF{5ZUB8_VLq
zwuY7XuffjK!SH_m-^H_0Nvz@g_5Dw!Od8uo?l&AyeKwQv??NXU!*Ggvy0oVXdpJ=S
z>tK?==pT$PBJ|xPg4|=jWssuB;IHpbs<}Isv>?iRR`FHZ*sJF;S<*^T!_yU(w&OTm
z*-)H~4Sm&><6Hoh`tL;Ll{F`L#jiZK3b=4CWS&0tU-M7tm;B4Q0Cwm>Eybk@HYgH|
z=N78YlbmExRJz_-r$k=uh&`ybUxYq1CCfIAo7*R@bDn<5S^7F=wY0?g3THbZK)qJm
z#m~ppq`~=CXgw`t%UQnaz3Wij<XpNpH;+rmFUwi!_+k@iJIJB=?vraAZ>%-A-VJ0o
za}KnML@lbVJ~YcuP&Wd7)s_LY^FVbK)D7H~)f`gyHKk--A?R=YtgPJulxrnsZHdsS
zLa3Il$F-Cw-jeSi&oykPVQ@#E-H?*h9ldw=UcGYVb+>skguF^~J_eIR+)l<&diRbY
z>W&8eeqS?abH0db|E_cU&q~1)?LfOz3dk1f9;+(2TT4eI+ph%CHLMSJf5EiT+SHZN
z&B=y3FPv8CgIcQJ#Ld%pbW>A3l&T>~ww1dG++^ya)$fXG&aS0WqBm@DHr)gEg_B?1
zXPy3&JstLcKtm?}<CXTct`G;(ZT}DZgW*>7{MXLY`}mJLd1?_}FvaMcqeQCL*7k?q
zbe7k&9BC=?97(eVlccmeQag)cg=bAsA|t7!cM;LjVcL1$ANt=q0GR96PH>DEhjBUr
z!cfh39Lfx7@6+ZHWK*@3QTnF$LKIG_KX3O0q<slVCCR~z|5*F<3N!UNjWP<O3I^&J
z3Qne31Znx30{{z1ibfz8?V$tA(yF(DRHx<x7^O2fP|$)Iit|HPBt^;I;me=4j!Ulr
zD5Yk#5tdg|&Ja))@`P<Aw1sh%LrN)05w%l<skpbCF-ig8rFI_*)U>XkjvcGEbth4%
zd!rIY$V}R)Qh`*W8c=%31i(aV48F9v#j>Lv1OZ9rh;nI#P80ll4m&p*WxyJ*z{Ckh
zG=Y)2S610BF<bzOq+XIG7CfEx6uc%B0h~<8$j*0UCPYBuI1?7Vyb?$1Cxo(IC`^qW
z!&48^V1_vgct%kVrr49HCrV|G!;O3)eptd)<+W9+i}gV=YsUx(j+OSB(RySr3PPJJ
zQjQLePjVeV4n~#wN>j@#vSJ7X!EiD`R1KnB$V=C*6t0~LP?n8j%vqlC4shaweJLem
zwhOsI8_Mf`_hF2peaO(Q4}hRF^8{g68-nUVNV~A2ntgi0I+NBgUiM5CmUwB}got4(
z7@I>b-EK7*WuE3a3rzAo6z&ts-cmfpNv%W$qrF-M$xaD?=00`}670V{ItE0Qslmh?
z#SKkW8aqPDqwwzNrNwCg0;)d%@x{ojMwXJ@SGz<b@b9y~je7s+{p0=r{+s>!w}z4}
zLu!AN{j5?k3$eTsYYFXiF*O0t1lLL1NDiu*c?K3!v!}IFGL@#Hw7gnC&KPwkzjO($
zPVy^uT4DA^=Sc17_I_T_EH<+&hKVPvcX?-=7Dc68L2cdEj!nf1g>Mrjp_eg4L6}Kc
z<)DO?UNv@kN@2oJ#GGH!t?%=K)fpf`$TpbO8EeFv`;{?N$8@!clH*dECW(>=VCeTP
zoEl)EB#WEc@HFZl0*XQ*5@A%I$}%X&CijPcgiWn@0LQ|t#ZBYt0g5IRvDpX7!t1hW
z49{OmN`dYAH=O8igEiP&DujDsjFTmN@IzkEus2E7PEhlGWcEc(P2KF6_3d&T04qOm
z!?y~~2WBbO80Sl~k)^Wtz?@wGHRa1Z`ua9?Ib)Vu?5@-OD*Zw_7l=vrB6U9Tz6Geh
z2wzU_kHx9jkKmC$b}N;*kFK?6q#bkCHo@aY;Q3PU=zkwv{BO^H(p;>Q*8r&ITV6`<
z7iFKIp@bs-$J&|Pk1d3mL~!a$_oX7MOC}Rn5qCn2qNYV8nM?qhqXgi|8ZBU^6XD`U
zDODk$RJZ<dK_-(ck<sMPUP8P>LUTryTWYOLs@SomYgc8`oE_WYezcE{H<LDo=Qz&d
z5!l_?+1lx#mM}rer|Hd;(P#x~y*qkkh$Vh5p%vhyrCYa7tBgjiq<V#tDW8qNZe5y#
z+ALOFIO<((Hn%9|pjDHvQT(;N4>qQlQ%DzbbG%kB$s(OZHBX7XA}#=&dxZzulZ!l^
zBQHx%6LOY#D%)Tq+>|i>icCqybA6iPW!lYQz0%Rknx><sB;z2GMH{GZYwCr@THG;S
z+{;p}`R6hb=<1|jM({?GHm_3uaYSY*Nf=s1eLu3xHj%l|oekJF^;zL5WG=Lw8z6v*
z)cEw<l9HUOTvt{3ZTwrc{$-fwxUXdt;ILIm_du)ie@(r9>xT4t<z?;Wjbl-!<R;U3
zd!%Uzq<7Y1D1~aPN*eKG(!?1Okn$9QN08}e#&XXL9P2o$Eq^O_-^gKmfAnI1_v!Yx
zzc#IBZCoZ}akU>n;%RoUPm#JPp!^hT=zHk>zUTelzW43F{eM6C^>6=X|9D)VlpVvQ
z_HkG61RUoDf#m(%8T;cirlF|r<>?<AJdYsvJv?OK<#XwyO(A1vgw~~?rArKV8d=DE
zuJce%p@)J(eec^}AHDbVuP5f!<9|H*x8M2w@so$^5L1qqvCjlYyheOR!a8MP6uq6)
zUwg}~c}3|DW5{r@LOHR(Hx^4No<oj4oT9~tPiM_#5_J>99}mY8<GxHny@G1BS;%sf
zaPu;jV<a~pLX(%dV?~x@oUZ_@bB7LYtEJ#7d{&hYQvOum<&)5<H(Ga4%fpGQx~SE)
zs<xAwjHRA>JukHZ^1X@<sO>V<k*Za&mq>O0DwDfILV`~7QVnC4cR=T04k3z3BF&>>
zx3Vr?RY0&b=NgQdE>q70PGX7C0i{JEpO)Sp)oWBV0wmu_(Mp0KqqLDdweM8vm^Mf;
zG-5GX(;;Oex!iEIBb;%*!;!zrm0ugN7Bf?J_bMI<#qIkfY*@)^2#aC{Q+=VZP=1;*
zy(&(vCSl`;+DpZ|mRZO+p)!?V@g^JBa+c{?4?bTyg#Zu=Map$#oxL}%uPZTI-ty0Y
uBq6phB@zvz@F%mMEna@<kcRu`{<(kdpZjNp=l>4?0RR7AqX<6$>Hz?V)0Y$g

literal 0
HcmV?d00001

diff --git a/charts/plural/charts/test-base-0.1.10.tgz b/charts/plural/charts/test-base-0.1.10.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..3d969faab31d431fd835f67ffc5e1466bb0e0b8c
GIT binary patch
literal 1702
zcmV;X23h$ZiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PI=eZ`-;N&u9J>H)juMvnN@0oMaHN4_*5(JZ$J2>Y~Fi3<V{f
zCB9H3A4xg&bF#mEASuhTqogU4rRbjdA*QI)@$Pu{yF13Bu~9}1j$c<)+jvE5e)Pm6
zNs{DzHuJwplI;H`)3fQ(WHy^kC&}sA*~L*ZIZe)IN02<VAVZ@umg=MA(R=MH_l*py
z*ay^xNs+>GN~luZ<0PJ(#|bIW<eDk#*O<t8Q=kD`AqdRT7^+vG(a1*UZe4<I1W+)n
zRvba`MpF(<SS&SlOu)Gu5wyk>I`1QPr7#7m6lb|7Bg>5(Nj!-s3HjQV`u`l;_+L`q
zp!r__z~|!se0shg|EJT7L;OF-FsPR-$5(kS8(~udK!uRjhoDJeeM5-OX#TF@Xi^dZ
zRqQWXHp)0s_o(8_Kbn|H0$UX5-fe=}5P&7>tbJ3W^}kot=9QmuW-KASFVYq{h|;o_
z7T?n{1!HN(kvN}y>+vJdL>^Iyv8cR^0b4fAck#=@6=fD0VHx)zMwNnG7r+c?q{WH=
zSgaMN7M-vFxfGT%fjT_G9(y-fO-oFn%yrD<I0$8`aTi;ugRt|KnCjA`@UPK&4e^H%
zb3MJ`=4SNoXT-W~{BN{2<Bt_`h1$ecJqZ+iCjL)nll}aEHakxa@&6oSy&j*CA3iB6
zijdQ3jUX3(p8JZBoQ!X7$a)<?feR)OMxD>Zj(P;q_C0O5g*cRwE<`&Qca%RZQEOHp
zT!Yn($l?6dPgy;077O+XM$rgbUMLDTC0@SQ8mUE~-42U}^A-HkP|g+%3m?R8hnV~W
z18+}n-40F*0~zMDF$hN12!Cxd)B-J<pzneqFAPwPz*)^K7Osx56*KT6TX|c&c{_Ks
zOq5_0<}YLN;{r5tq^31mixVc8Evz}XVVpyT&=@DD0qTWsrM<_rj%wGuY|&YB^RlyO
zOLFJ?hgh7Oj?eGC^y!}-exzF&J39m>@w;H8@a;y<oy9K{PH86W0!H7N=sPpo;}tf2
zxPuK(cigUbo-Rt-y40PeKhxGh0u`qj@_WzK(`^rRUzxt0!@RA>;Tkk5PIH9OA4V|x
zIQsH1l65UbkkQ;HW1t8^R><qvRAVo93hVWz2N+N)4%-e<8045+ssGlpj(Z-{D*CGH
zJ={BAS#)vg@@m%*xXgL$lWX{;krww9zs;qlf|giB*(xyFc+Wf(LW72zx57Wbbo+Wn
zgF=K7V%Sn4=;LAOnJ|`$9Cu~!ht`k>?*n^V^Z^Z3p98zb;Qea#%fz>L;nFTyoQLiA
z(!+}ZrMGAozr2f^=xf=-gALzNI~hHQ!L6A8+L`$4jG_9^75q=x2Y#mho7}GdW*3M4
z?|H_~{m+D4GEt;3--#PiqooD4)HOf>xu`B>gr6{PtkeWrTnr78hlJY^&O6}02Ejyu
z!otkOUHIaP+3K#i?RBK#gMN$J?P=vdY0dBA-v)UUMWnB?cXis>N^172=h(Kh<IWiG
zB*y_0TuFVo;PNWc?)~FTphI`PUUy2ghUi-FN67wXCJH9XyH0UOk0@)2AE}Sz_zoBT
zHle*QxJO(9(6jWgeNB`7jJa*^4+gz-+nVotXIM9i4&_b1e8B%c{=2nj#Q)@CI@$04
zlVozh|K}KeK=J1uZm(R$znoC6D!Rdv_h{_AVRi@%dv{rz%Q?8YiPme-R1~iqo3~93
zXK)Q%UZD=S{J5-fD+z2ml}gIX6qGbJ^5rt;-}{F~m6{evT>qZ>>q;dJvr?~i6xh9t
zBLMvy$R6Ex`Hn1RY1!s0H%mRqP?nnB%2ELBU1pov6o(gknZXmh^n7+1ec}0U<3D!x
zW2KN9pV-Gf7yoCcXZ!d6(~Gl1{6EJyhQCv5Q49aCyKww)RiS{aVcgXMplE(cOEfV#
zhW8aSU>c>QwgyavoI}ZF1~s*L#YFi%XynwgC4!>1>a9~zkYf;7hR}MUG%naDEJD!y
z?qv)=3BCd;{FhE7P^f`3fia2S%s<Yp)JTq@y~g<PdJYBChQuYaWB)gZPvY!XJ@$V$
z3spIGe>RV1DaKny8O<*n1q;T}kdxS4DRL5L^pc#!wsv!=SxHX*LyqAC)l4=9eth$T
wAr1jtQ9@!?ARPyCEq^BQ(&Vzh@o%)GIE=$MjBjN8Hvj<t{|iz_bpRv)01EI;r~m)}

literal 0
HcmV?d00001

diff --git a/charts/plural/deps.yaml b/charts/plural/deps.yaml
new file mode 100644
index 0000000000..3892e192aa
--- /dev/null
+++ b/charts/plural/deps.yaml
@@ -0,0 +1,37 @@
+apiVersion: plural.sh/v1alpha1
+kind: Dependencies
+metadata:
+  application: true
+  description: deploys plural's api and background services
+spec:
+  dependencies:
+  - type: helm
+    name: bootstrap
+    repo: bootstrap
+    version: '>= 0.5.1'
+  - type: helm
+    name: ingress-nginx
+    repo: ingress-nginx
+    version: '>= 0.1.2'
+  - type: helm
+    name: postgres
+    repo: postgres
+    version: '>= 0.1.0'
+  - type: helm
+    name: cluster-operator
+    repo: rabbitmq
+    version: '>= 0.1.11'
+  - type: helm
+    name: influx
+    repo: influx
+    version: '>= 0.1.10'
+  - type: terraform
+    name: aws
+    repo: plural
+    version: '>= 0.1.1'
+    optional: true
+  - type: terraform
+    name: gcp
+    repo: plural
+    version: '>= 0.1.0'
+    optional: true
diff --git a/charts/plural/runbooks/db-scaling-manual.xml b/charts/plural/runbooks/db-scaling-manual.xml
new file mode 100644
index 0000000000..91c281e2aa
--- /dev/null
+++ b/charts/plural/runbooks/db-scaling-manual.xml
@@ -0,0 +1,57 @@
+<root gap='medium'>
+  <box pad='small' gap='medium' direction='row' align='center'>
+    <box direction='row' align='center' gap='small'>
+      <box gap='small' align='center'>
+        <timeseries datasource="cpu" label="CPU Usage" />
+        <text size='small'>You should set a reservation to 
+          roughly correspond to 30% utilization</text>
+      </box>
+      <box gap='small' align='center'>
+        <timeseries datasource="memory" label="Memory Usage" />
+        <text size='small'>You should set a reservation to 
+          roughly correspond to 60% utilization</text>
+      </box>
+    </box>
+    <box gap='small'>
+      <box gap='xsmall'>
+        <input placeholder="250m" label='CPU Request' name='cpu'>
+          <valueFrom 
+            datasource="statefulset" 
+            doc="kubernetes.raw" 
+            path="spec.template.spec.containers[0].resources.requests.cpu" />
+        </input>
+        <input placeholder="1Gi" label='Memory Request' name='memory'>
+          <valueFrom 
+            datasource="statefulset" 
+            doc="kubernetes.raw" 
+            path="spec.template.spec.containers[0].resources.requests.memory" />
+        </input>
+      </box>
+      <box direction='row' justify='end'>
+        <button label='Scale' action='scale' primary='true' />
+      </box>
+    </box>
+  </box>
+  <box direction='row' align='center' gap='small'>
+    <box gap='small' align='center'>
+      <timeseries datasource="volume" label="Volume Usage" />
+      <text size='small'>You should resize at around 80% utilization (or based on dataset growth)</text>
+    </box>
+    <box gap='small'>
+      <input placeholder="25Gi" label='Volume Size' name='volume'>
+        <valueFrom 
+          datasource="statefulset" 
+          doc="kubernetes.raw" 
+          path="spec.volumeClaimTemplates[0].spec.resources.requests.storage" />
+      </input>
+    </box>
+  </box>
+  <box width='100%' gap='small'>
+    <text size='small'>Be sure to scale your postgres pods within your nodes capacities, listed here:</text>
+    <table width='100%' datasource='nodes' path='nodes'>
+      <tableColumn path='metadata.name' header='name' width='33%' />
+      <tableColumn path='status.capacity.cpu' header='cpu' width='33%' />
+      <tableColumn path='status.capacity.memory' header='memory' width='33%' />
+    </table>
+  </box>
+</root>
\ No newline at end of file
diff --git a/charts/plural/templates/NOTES.txt b/charts/plural/templates/NOTES.txt
new file mode 100644
index 0000000000..0fd05c1b06
--- /dev/null
+++ b/charts/plural/templates/NOTES.txt
@@ -0,0 +1,21 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "plural.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "plural.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "plural.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "plural.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl port-forward $POD_NAME 8080:80
+{{- end }}
diff --git a/charts/plural/templates/_helpers.tpl b/charts/plural/templates/_helpers.tpl
new file mode 100644
index 0000000000..0599b13896
--- /dev/null
+++ b/charts/plural/templates/_helpers.tpl
@@ -0,0 +1,102 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "plural.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "plural.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "plural.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "plural.labels" -}}
+app.kubernetes.io/name: {{ include "plural.name" . }}
+helm.sh/chart: {{ include "plural.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+
+{{- define "plural.env" -}}
+- name: HOST
+  value: {{ .Values.ingress.dns }}
+- name: NAMESPACE
+  valueFrom:
+    fieldRef:
+      fieldPath: metadata.namespace
+- name: POD_IP
+  valueFrom:
+    fieldRef:
+      fieldPath: status.podIP
+- name: POSTGRES_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.dbPasswordSecret }}
+      key: password
+- name: RABBIT_USERNAME
+  valueFrom:
+    secretKeyRef:
+      name: rabbitmq-default-user
+      key: username
+- name: RABBIT_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: rabbitmq-default-user
+      key: password
+- name: INFLUX_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: influxdb-auth
+      key: influxdb-password
+- name: RABBIT_NAMESPACE
+  value: {{ .Values.rabbitmqNamespace }}
+- name: DBHOST
+  value: plural-plural
+- name: DBSSL
+  value: 'true'
+{{ if .Values.sentryDsn }}
+- name: SENTRY_DSN
+  value: {{ .Values.sentryDsn | quote }}
+{{ end }}
+{{- end -}}
+
+{{- define "plural.image" -}}
+{{ .Values.global.registry }}/{{ .repository }}:{{ .tag }}
+{{- end -}}
+
+{{- define "plural.migration-name" -}}
+plural-migration-{{ .Values.global.tag | default .Values.image.tag | default .Chart.AppVersion | sha256sum | trunc 8 }}
+{{- end -}}
+
+
+{{- define "plural.imageTag" -}}
+{{ .Values.global.tag | default .Values.image.tag | default .Chart.AppVersion }}
+{{- end -}}
\ No newline at end of file
diff --git a/charts/plural/templates/chartmuseum.yaml b/charts/plural/templates/chartmuseum.yaml
new file mode 100644
index 0000000000..04e62b72e5
--- /dev/null
+++ b/charts/plural/templates/chartmuseum.yaml
@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: chartmuseum
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.chartmuseum.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: chartmuseum
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: chartmuseum
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: chartmuseum
+        image: "{{ .Values.chartmuseum.repository }}:{{ .Values.chartmuseum.tag }}"
+        imagePullPolicy: {{ .Values.chartmuseum.pullPolicy }}
+        env:
+        - name: PORT
+          value: '8080'
+        - name: DEPTH
+          value: '1'
+        - name: CONTEXT_PATH
+          value: '/cm'
+        {{ if eq .Values.provider "aws" }}
+        - name: STORAGE
+          value: amazon
+        {{ else }}
+        - name: STORAGE
+          value: {{ .Values.provider }}
+        {{ end }}
+        - name: STORAGE_GOOGLE_BUCKET
+          value: {{ .Values.chartmuseum.bucket }}
+        - name: STORAGE_GOOGLE_PREFIX
+          value: ""
+        - name: STORAGE_AMAZON_BUCKET
+          value: {{ .Values.chartmuseum.bucket }}
+        - name: STORAGE_AMAZON_PREFIX
+          value: ""
+        - name: STORAGE_AMAZON_REGION
+          value: {{ .Values.region }}
+        - name: AWS_SDK_LOAD_CONFIG
+          value: "1"  
+        ports:
+        - name: http
+          containerPort: 8080
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /cm/health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /cm/health
+            port: http
+        resources:
+          {{- toYaml .Values.chartmuseum.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.chartmuseum.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/plural/templates/cron.yaml b/charts/plural/templates/cron.yaml
new file mode 100644
index 0000000000..b1405ee2f3
--- /dev/null
+++ b/charts/plural/templates/cron.yaml
@@ -0,0 +1,51 @@
+{{- define "plural.envvar" -}}
+- name: {{ .name }}
+  value: {{ .value | quote }}
+{{- end -}}
+
+{{- define "plural.cron" -}}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .cronName }}
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  schedule: {{ .crontab | quote }}
+  successfulJobsHistoryLimit: 2
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          serviceAccountName: plural
+          {{- with .Values.imagePullSecrets }}
+          imagePullSecrets:
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          containers:
+          - name: cron
+            image: "{{ .Values.global.registry }}/{{ .Values.cron.repository }}:{{ include "plural.imageTag" . }}"
+            imagePullPolicy: {{ .Values.image.pullPolicy }}
+            envFrom:
+            - secretRef:
+                name: plural-env
+            env:
+            - name: CRON
+              value: {{ .cronModule }}
+            {{ include "plural.env" . | nindent 12 }}
+            {{ range .envVars }}
+              {{ include "plural.envvar" . | nindent 12 }}
+            {{ end }}
+            resources:
+              {{- toYaml .Values.cron.resources | nindent 14 }}
+{{- end -}}
+
+{{ $context := . }}
+{{ range $index, $cron := .Values.crons }}
+  {{- $args := mergeOverwrite $context $cron }}
+  {{ if $index }}
+---
+  {{ end }}
+  {{ include "plural.cron" $args | nindent 0 }}
+{{- end -}}
diff --git a/charts/plural/templates/dashboards.yaml b/charts/plural/templates/dashboards.yaml
new file mode 100644
index 0000000000..b2cefd73ab
--- /dev/null
+++ b/charts/plural/templates/dashboards.yaml
@@ -0,0 +1,101 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: Dashboard
+metadata:
+  name: {{ template "plural.fullname" $ }}-beam
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: beam
+  description: internal erlang telemetry for plural's api
+  timeslices: [30m, 1h, 2h, 1d]
+  defaultTime: 30m
+  labels:
+  - name: "service"
+    query:
+      query: erlang_vm_ets_limit{app_kubernetes_io_instance="{{ .Release.Name }}"}
+      label: app_kubernetes_io_name
+  graphs:
+  - queries:
+    - query: avg(erlang_vm_process_limit{app_kubernetes_io_name="$service"})
+      legend: process limit
+    - query: avg(erlang_vm_process_count{app_kubernetes_io_name="$service"})
+      legend: process count
+    name: Process details
+  - queries:
+    - query: avg(erlang_vm_memory_bytes_total{app_kubernetes_io_name="$service", kind="processes"})
+      legend: process memory
+    - query: avg(erlang_vm_memory_system_bytes_total{app_kubernetes_io_name="$service", usage="binary"})
+      legend: binary heap memory
+    - query: avg(erlang_vm_memory_system_bytes_total{app_kubernetes_io_name="$service", usage="code"})
+      legend: code memory
+    - query: avg(erlang_vm_memory_system_bytes_total{app_kubernetes_io_name="$service", usage="ets"})
+      legend: ets memory
+    format: bytes
+    name: VM memory
+  - queries:
+    - query: irate(erlang_vm_statistics_context_switches{app_kubernetes_io_name="$service"}[5m])
+      legend: context switches
+    - query: irate(erlang_vm_statistics_reductions_total{app_kubernetes_io_name="$service"}[5m])
+      legend: reductions
+    format: none
+    name: runtime performance
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Dashboard
+metadata:
+  name: {{ template "plural.fullname" $ }}-postgres
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: postgres
+  description: Monitoring for plural's postgres db
+  timeslices: [30m, 1h, 2h, 1d]
+  defaultTime: 30m
+  labels:
+  - name: instance
+    query:
+      query: pg_stat_database_tup_fetched{namespace="{{ .Release.Namespace }}"}
+      label: instance
+  graphs:
+  - queries:
+    - query: SUM(pg_stat_database_tup_fetched{instance=~"$instance"})
+      legend: tuples fetched
+    - query: SUM(pg_stat_database_tup_inserted{instance=~"$instance"})
+      legend: tuples inserted
+    - query: SUM(pg_stat_database_tup_updated{instance=~"$instance"})
+      legend: tuples updated
+    name: Storage Performance
+  - queries:
+    - query: pg_settings_max_connections{instance="$instance"}
+      legend: connections
+    name: Max Connections
+  - queries:
+    - query: avg(rate(process_cpu_seconds_total{instance="$instance"}[5m]) * 1000)
+      legend: seconds
+    name: CPU time
+  - queries:
+    - query: avg(rate(process_resident_memory_bytes{instance="$instance"}[5m]))
+      legend: resident mem
+    - query: avg(rate(process_virtual_memory_bytes{instance="$instance"}[5m]))
+      legend: process mem
+    format: bytes
+    name: Memory utilization
+  - queries:
+    - query: process_open_fds{instance="$instance"}
+      legend: fds
+    name: Open file descriptors
+  - queries:
+    - query: pg_settings_max_wal_size_bytes{instance="$instance"}
+      legend: WAL size
+    format: bytes
+    name: Max WAL size
+  - queries:
+    - query: irate(pg_stat_database_xact_commit{instance="$instance"}[5m])
+      legend: commits
+    - query: irate(pg_stat_database_xact_rollback{instance="$instance"}[5m])
+      legend: rollbacks
+    name: Transactions
+  - queries:
+    - query: pg_stat_database_blks_hit{instance="$instance"} / (pg_stat_database_blks_read{instance="$instance"} + pg_stat_database_blks_hit{instance="$instance"})
+      legend: hit rate
+    name: Cache hit rate
\ No newline at end of file
diff --git a/charts/plural/templates/deployment.yaml b/charts/plural/templates/deployment.yaml
new file mode 100644
index 0000000000..8b29029abf
--- /dev/null
+++ b/charts/plural/templates/deployment.yaml
@@ -0,0 +1,344 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-api
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-api
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-api
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        plural.sh/monitoring: scrape
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: {{ .Values.api.port | quote }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: api
+        image: "{{ .Values.global.registry }}/{{ .Values.image.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.api.port }}
+          protocol: TCP
+        - name: epmd
+          containerPort: 4369
+          protocol: TCP
+        - name: mcp
+          containerPort: {{ .Values.mcp.port }}
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /__traffic
+            port: http
+        resources:
+          {{- toYaml .Values.api.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.api.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-worker
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  {{ if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.worker.replicaCount }}
+  {{ end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-worker
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-worker
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: worker
+        image: "{{ .Values.global.registry }}/{{ .Values.worker.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+        {{- if .Values.worker.extraEnv }}
+        {{ .Values.worker.extraEnv | toYaml | nindent 8 }}
+        {{- end }}
+        - name: DOCKER_SCAN_POLL_INTERVAL
+          value: {{ .Values.worker.dockerScan.pollInterval | quote }}
+        - name: DOCKER_SCAN_PARALLELISM
+          value: {{ .Values.worker.dockerScan.parallelism | quote }}
+        resources:
+          {{- toYaml .Values.worker.resources | nindent 12 }}
+      {{- with .Values.worker.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.worker.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.worker.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-rtc
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.rtc.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-rtc
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-rtc
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        plural.sh/monitoring: scrape
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: {{ .Values.api.port | quote }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: rtc
+        image: "{{ .Values.global.registry }}/{{ .Values.rtc.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.api.port }}
+          protocol: TCP
+        - name: epmd
+          containerPort: 4369
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /__traffic
+            port: http
+        resources:
+          {{- toYaml .Values.rtc.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.rtc.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-www
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.www.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-www
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-www
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: www
+        image: "{{ .Values.global.registry }}/{{ .Values.www.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.www.port }}
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /
+            port: http
+        resources:
+          {{- toYaml .Values.www.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.www.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-mcp
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-mcp
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-mcp
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        plural.sh/monitoring: scrape
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: {{ .Values.api.port | quote }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: plural
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 6 }}
+    {{- end }}
+      containers:
+      - name: api
+        image: "{{ .Values.global.registry }}/{{ .Values.image.repository }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        - name: PLRL_IGNORE_CLUSTER
+          value: "true"
+        {{ include "plural.env" . | nindent 8 }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.api.port }}
+          protocol: TCP
+        - name: epmd
+          containerPort: 4369
+          protocol: TCP
+        - name: mcp
+          containerPort: {{ .Values.mcp.port }}
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /__traffic
+            port: http
+        resources:
+          {{- toYaml .Values.api.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- with .Values.api.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
\ No newline at end of file
diff --git a/charts/plural/templates/hpa.yaml b/charts/plural/templates/hpa.yaml
new file mode 100644
index 0000000000..d3190616b0
--- /dev/null
+++ b/charts/plural/templates/hpa.yaml
@@ -0,0 +1,20 @@
+{{ if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: worker-autoscaling
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: plural-worker
+  minReplicas: {{ .Values.worker.minReplicas }}
+  maxReplicas: {{ .Values.worker.maxReplicas }}
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 80
+{{ end }}
\ No newline at end of file
diff --git a/charts/plural/templates/hydra-postgres.yaml b/charts/plural/templates/hydra-postgres.yaml
new file mode 100644
index 0000000000..6dce55e97c
--- /dev/null
+++ b/charts/plural/templates/hydra-postgres.yaml
@@ -0,0 +1,94 @@
+apiVersion: acid.zalan.do/v1
+kind: postgresql
+metadata:
+  name: plural-hydra
+  labels:
+    app: postgres-hydra
+    db: hydra
+  {{ include "plural.labels" . | nindent 4 }}
+spec:
+  teamId: plural
+  volume:
+    size: {{ .Values.postgres.hydra.size }}
+  numberOfInstances: 2
+  {{ if .Values.postgres.hydra.resources }}
+  resources:
+  {{ mergeOverwrite .Values.postgres.default.resources .Values.postgres.hydra.resources | toYaml | nindent 4 }}
+  {{ end }}
+  users:
+    hydra:  # database owner
+    - superuser
+    - createdb
+  databases:
+    hydra: hydra  # dbname: owner
+  postgresql:
+    version: "13"
+  {{- with .Values.postgres.hydra.nodeAffinity }}
+  nodeAffinity:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.postgres.hydra.tolerations }}
+  tolerations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  sidecars:
+  - image: gcr.io/pluralsh/postgres-exporter:0.8.0
+    name: exporter
+    ports:
+    - containerPort: 9187
+      name: http-metrics
+      protocol: TCP
+    env:
+    - name: "DATA_SOURCE_URI"
+      value: "127.0.0.1:5432/hydra?sslmode=disable"
+    - name: "DATA_SOURCE_USER"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-hydra.credentials.postgresql.acid.zalan.do
+          key: username
+    - name: "DATA_SOURCE_PASS"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-hydra.credentials.postgresql.acid.zalan.do
+          key: password
+    livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+    readinessProbe:
+      livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hydra-master
+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: master
+    cluster-name: plural-hydra
\ No newline at end of file
diff --git a/charts/plural/templates/ingress.yaml b/charts/plural/templates/ingress.yaml
new file mode 100644
index 0000000000..a441a917d6
--- /dev/null
+++ b/charts/plural/templates/ingress.yaml
@@ -0,0 +1,94 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: plural
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - {{ .Values.ingress.dns }}
+    - {{ .Values.ingress.dkr_dns }}
+    secretName: plural-tls
+  rules:
+  - host: {{ .Values.ingress.dns }}
+    http:
+      paths:
+      - path: /artifacts/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /cm/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /gql
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /graphiql
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /auth/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /api/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /webhooks/.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-api
+            port:
+              name: http
+      - path: /socket.*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-rtc
+            port:
+              name: http
+      - pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-www
+            port:
+              name: http
+  - host: {{ .Values.ingress.dkr_dns }}
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        backend:
+          service:
+            name: plural-registry
+            port:
+              name: http
+{{- end }}
diff --git a/charts/plural/templates/logtails.yaml b/charts/plural/templates/logtails.yaml
new file mode 100644
index 0000000000..6e161ef23f
--- /dev/null
+++ b/charts/plural/templates/logtails.yaml
@@ -0,0 +1,27 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: LogFilter
+metadata:
+  name: dns-creates
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: dns entry creates
+  description: stream of calls to create dns entries
+  query: Attempted to create record
+  labels:
+  - name: job
+    value: plural/plural-api
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: LogFilter
+metadata:
+  name: dns-deletes
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: dns entry deletes
+  description: stream of calls to remove dns entries
+  query: Attempted to delete record
+  labels:
+  - name: job
+    value: plural/plural-api
\ No newline at end of file
diff --git a/charts/plural/templates/migration.yaml b/charts/plural/templates/migration.yaml
new file mode 100644
index 0000000000..1d78aad26f
--- /dev/null
+++ b/charts/plural/templates/migration.yaml
@@ -0,0 +1,107 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "plural.migration-name" . }}
+  annotations:
+    platform.plural.sh/ignore: 'true'
+spec:
+  template:
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: migrator
+        image: "{{ .Values.global.registry }}/{{ .Values.image.repository }}:{{ include "plural.imageTag" . }}"
+        command: ["/opt/app/bin/plural",  "migrate"]
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        - secretRef:
+            name: plural-migration-env
+        env:
+        {{ include "plural.env" . | nindent 8 }}
+      restartPolicy: Never
+  backoffLimit: 5
+{{ if .Values.scanPackages }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: scan-packages-{{ randAlphaNum 4 | lower }}
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  backoffLimit: 10
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: plural
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: cron
+        image: "{{ .Values.cron.image }}:{{ include "plural.imageTag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        envFrom:
+        - secretRef:
+            name: plural-env
+        env:
+        - name: CRON
+          value: Task.VersionScan
+        {{ include "plural.env" . | nindent 8 }}
+        resources:
+          {{- toYaml .Values.cron.resources | nindent 10 }}
+{{ end }}
+{{ if .Values.createHydraDb }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-hydra-db
+spec:
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: plural
+      containers:
+      - name: createdb
+        image: postgres:14
+        command: 
+        - "/bin/sh"
+        - "-c"
+        - |
+          psql "$POSTGRES_URL" -c "CREATE DATABASE hydra"
+        envFrom:
+        - secretRef:
+            name: plural-env
+  backoffLimit: 5
+{{ end }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: hydra-migration-{{ .Values.image.tag | default .Chart.AppVersion | sha256sum | trunc 8 }}
+  annotations:
+    platform.plural.sh/ignore: 'true'
+spec:
+  backoffLimit: 10
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: hydra-migration
+        image: "{{ .Values.hydra.image.repository }}:{{ .Values.hydra.image.tag }}"
+        imagePullPolicy: {{ .Values.hydra.image.pullPolicy }}
+        command: ["hydra"]
+        args: ["migrate", "sql", "-e", "--yes"]
+        env:
+        - name: DSN
+          valueFrom:
+            secretKeyRef:
+              name: plural-hydra
+              key: dsn
diff --git a/charts/plural/templates/monitor.yaml b/charts/plural/templates/monitor.yaml
new file mode 100644
index 0000000000..c944198acb
--- /dev/null
+++ b/charts/plural/templates/monitor.yaml
@@ -0,0 +1,20 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "plural.fullname" . }}
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  podMetricsEndpoints:
+  - port: http
+    path: '/metrics'
+  namespaceSelector:
+    matchNames:
+    - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      plural.sh/monitoring: scrape
+  podTargetLabels:
+    - app.kubernetes.io/name
+    - app.kubernetes.io/instance
\ No newline at end of file
diff --git a/charts/plural/templates/namespace.yaml b/charts/plural/templates/namespace.yaml
new file mode 100644
index 0000000000..186d355687
--- /dev/null
+++ b/charts/plural/templates/namespace.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: plrl-shell
+  labels:
+    app.kubernetes.io/managed-by: plural
+    app.plural.sh/name: plural
\ No newline at end of file
diff --git a/charts/plural/templates/networkpolicy.yaml b/charts/plural/templates/networkpolicy.yaml
new file mode 100644
index 0000000000..d271814fdd
--- /dev/null
+++ b/charts/plural/templates/networkpolicy.yaml
@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: shell-network-policy
+  namespace: plrl-shell
+spec:
+  podSelector:
+    matchLabels:
+      app.plural.sh/type: shell
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          "kubernetes.io/metadata.name": {{ .Release.Namespace }}
+    ports:
+    - protocol: TCP
+      port: 8080
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+      namespaceSelector:
+        matchLabels:
+          "kubernetes.io/metadata.name": kube-system
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 169.254.0.0/16
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
\ No newline at end of file
diff --git a/charts/plural/templates/postgres.yaml b/charts/plural/templates/postgres.yaml
new file mode 100644
index 0000000000..45ff4b28bd
--- /dev/null
+++ b/charts/plural/templates/postgres.yaml
@@ -0,0 +1,141 @@
+apiVersion: acid.zalan.do/v1
+kind: postgresql
+metadata:
+  name: plural-plural
+  labels:
+    app: postgres
+    db: plural
+  {{ include "plural.labels" . | nindent 4 }}
+spec:
+  teamId: plural
+  volume:
+    size: {{ .Values.postgres.plural.size }}
+  numberOfInstances: 2
+  {{ if .Values.postgres.plural.resources }}
+  resources:
+  {{ mergeOverwrite .Values.postgres.default.resources .Values.postgres.plural.resources | toYaml | nindent 4 }}
+  {{ end }}
+  users:
+    plural:  # database owner
+    - superuser
+    - createdb
+  databases:
+    plural: plural  # dbname: owner
+  postgresql:
+    version: "13"
+    parameters:
+      max_connections: '101'
+  {{- with .Values.postgres.plural.nodeAffinity }}
+  nodeAffinity:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.postgres.plural.tolerations }}
+  tolerations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  sidecars:
+  - image: gcr.io/pluralsh/postgres-exporter:0.8.0
+    name: exporter
+    ports:
+    - containerPort: 9187
+      name: http-metrics
+      protocol: TCP
+    env:
+    - name: "DATA_SOURCE_URI"
+      value: "127.0.0.1:5432/plural?sslmode=disable"
+    - name: "DATA_SOURCE_USER"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-plural.credentials.postgresql.acid.zalan.do
+          key: username
+    - name: "DATA_SOURCE_PASS"
+      valueFrom:
+        secretKeyRef:
+          name: postgres.plural-plural.credentials.postgresql.acid.zalan.do
+          key: password
+    livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+    readinessProbe:
+      livenessProbe:
+      failureThreshold: 6
+      httpGet:
+        path: /
+        port: http-metrics
+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-master
+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: master
+    cluster-name: plural-plural
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-master-scrape
+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9187"
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: master
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-replica
+  labels:
+    spilo-role: replica
+    {{ include "plural.labels" . | nindent 4 }}
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9187"
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics
+  selector:
+    spilo-role: replica
+    cluster-name: plural-plural
diff --git a/charts/plural/templates/prometheusrule.yaml b/charts/plural/templates/prometheusrule.yaml
new file mode 100644
index 0000000000..ad9006fbee
--- /dev/null
+++ b/charts/plural/templates/prometheusrule.yaml
@@ -0,0 +1,118 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: plural-uptime-rules
+spec:
+  groups:
+  - name: plural
+    rules:
+    - alert: PluralDBUp
+      expr: sum(up{namespace="plural", pod=~"plural-plural-[0-9]*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural db replicas are up
+        description: Validate there are not any issues in the cluster or database configuration
+    - alert: PluralHydraDBUp
+      expr: sum(up{namespace="plural", pod=~"plural-hydra-[0-9]*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural hydra db replicas are up
+        description: Validate there are not any issues in the cluster or database configuration
+    - alert: PluralAPIUp
+      expr: sum(up{namespace="plural", pod=~"plural-api-.*-.*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural api replicas are up
+        description: validate no code changes are infrastructure issues are causing unavailability
+    - alert: PluralRtcUp
+      expr: sum(up{namespace="plural", pod=~"plural-rtc-.*-.*"}) < 1
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: No plural rtc replicas are up
+        description: validate no code changes are infrastructure issues are causing unavailability
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  creationTimestamp: null
+  labels:
+    prometheus: example
+    role: alert-rules
+  name: plural-rules
+spec:
+  groups:
+  - name: plural
+    rules:
+    - alert: PluralHydraCPU
+      expr: |
+        (
+          sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"}[5m])) 
+          / sum(kube_pod_container_resource_requests{endpoint="http",namespace="{{ .Release.Namespace }}", pod=~"plural-hydra-[0-9]+", resource="cpu"})
+        )  > 0.6
+      for: 5m
+      labels:
+        severity: warning
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural hydra dbs's cpu has gotten too high
+        description: the cpu utilization of your plural hydra is higher than recommended
+    - alert: PluralHydraMEM
+      expr: |
+        (
+          sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"})
+          / sum(kube_pod_container_resource_requests{endpoint="http",resource="memory",namespace="{{ .Release.Namespace }}", pod=~"plural-hydra-[0-9]+"})
+        )  > 1
+      for: 5m
+      labels:
+        severity: warning
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural hydra db's memory has gotten too high
+        description: the memory utilization of your plural hydra db is higher than recommended
+    - alert: PluralDbCPU
+      expr: |
+        (
+          sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"}[5m])) 
+          / sum(kube_pod_container_resource_requests{endpoint="http",namespace="{{ .Release.Namespace }}", pod=~"plural-plural-[0-9]+", resource="cpu"})
+        )  > 0.6
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural's postgres cpu has gotten too high
+        description: the cpu utilization of your plural deployment's postgres db is higher than recommended
+    - alert: PluralDbMEM
+      expr: |
+        (
+          sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"})
+          / sum(kube_pod_container_resource_requests{endpoint="http",resource="memory",namespace="{{ .Release.Namespace }}", pod=~"plural-plural-[0-9]+"})
+        )  > 1
+      for: 5m
+      labels:
+        severity: warning
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: plural postgres memory has gotten too high
+        description: the memory utilization of your plural deployment's postgres db is higher than recommended
+    - alert: PluralShellHangs
+      expr: sum(kube_pod_status_phase{phase="Pending",namespace="plrl-shell"}) > 0
+      for: 5m
+      labels:
+        severity: critical
+        namespace: {{ .Release.Namespace }}
+      annotations:
+        summary: count of hanging shell pods
+        description: if shells aren't starting there's probably something critical failing, ie a misconfigured docker image
diff --git a/charts/plural/templates/proxies.yaml b/charts/plural/templates/proxies.yaml
new file mode 100644
index 0000000000..7b7fe17427
--- /dev/null
+++ b/charts/plural/templates/proxies.yaml
@@ -0,0 +1,87 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: dbsh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: statefulset/plural-plural
+  shConfig:
+    command: "/bin/bash"
+    args: []
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: db
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: db
+  target: service/plural-master
+  credentials:
+    secret: plural.plural-plural.credentials.postgresql.acid.zalan.do
+    key: password
+    user: plural
+  dbConfig:
+    name: plural
+    engine: postgres
+    port: 5432
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: hydradb
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: db
+  target: service/plural-hydra
+  credentials:
+    secret: hydra.plural-hydra.credentials.postgresql.acid.zalan.do
+    key: password
+    user: hydra
+  dbConfig:
+    name: hydra
+    engine: postgres
+    port: 5432
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: sh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: deployment/plural-api
+  shConfig:
+    command: /opt/app/bin/plural
+    args: [remote_console]
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: rtcsh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: deployment/plural-rtc
+  shConfig:
+    command: /opt/app/bin/rtc
+    args: [remote_console]
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Proxy
+metadata:
+  name: worker-sh
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: sh
+  target: deployment/plural-worker
+  shConfig:
+    command: /opt/app/bin/worker
+    args: [remote_console]
\ No newline at end of file
diff --git a/charts/plural/templates/rbac.yaml b/charts/plural/templates/rbac.yaml
new file mode 100644
index 0000000000..279d6f6d4b
--- /dev/null
+++ b/charts/plural/templates/rbac.yaml
@@ -0,0 +1,65 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: plural-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["endpoints", "pods"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["batch", "extensions"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: plural-shell-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["pods", "pods/exec", "pods/status"]
+  verbs: ["*"]
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: plural
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+  annotations:
+  {{ toYaml .Values.rbac.serviceAccountAnnotations | nindent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: plural-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: plural
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: plural-role
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: plural-shell-role
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: plural
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: plural-shell-role
\ No newline at end of file
diff --git a/charts/plural/templates/registry-config.yaml b/charts/plural/templates/registry-config.yaml
new file mode 100644
index 0000000000..a93c07fb8a
--- /dev/null
+++ b/charts/plural/templates/registry-config.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plural-registry-config
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+data:
+  config.yml: |-
+{{ toYaml .Values.registry.configData | indent 4 }}
+  cert.pem: {{ .Values.secrets.jwt_cert | quote }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plural-registry-aws-config
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+data:
+  config: >-
+    [default]
+    region=us-east-2
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-registry-secret
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+type: Opaque
+data:
+  {{- if .Values.registry.secrets.haSharedSecret }}
+  haSharedSecret: {{ .Values.registry.secrets.haSharedSecret | b64enc | quote }}
+  {{- else }}
+  haSharedSecret: {{ randAlphaNum 16 | b64enc | quote }}
+  {{- end }}
\ No newline at end of file
diff --git a/charts/plural/templates/registry.yaml b/charts/plural/templates/registry.yaml
new file mode 100644
index 0000000000..26980be573
--- /dev/null
+++ b/charts/plural/templates/registry.yaml
@@ -0,0 +1,111 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plural-registry
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: plural-registry
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  replicas: {{ .Values.registry.replicaCount }}
+{{- if .Values.registry.updateStrategy }}
+  strategy:
+{{ toYaml .Values.registry.updateStrategy | indent 4 }}
+{{- end }}
+  minReadySeconds: 5
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plural-registry
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/registry-config.yaml") . | sha256sum }}
+{{- if $.Values.registry.podAnnotations }}
+{{ toYaml $.Values.registry.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      serviceAccountName: plural
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+      {{- end }}
+{{- if .Values.registry.priorityClassName }}
+      priorityClassName: "{{ .Values.registry.priorityClassName }}"
+{{- end }}
+{{- if .Values.registry.securityContext.enabled }}
+      securityContext:
+        fsGroup: {{ .Values.registry.securityContext.fsGroup }}
+        runAsUser: {{ .Values.registry.securityContext.runAsUser }}
+{{- end }}
+      containers:
+        - name: registry
+          image: "{{ .Values.registry.image.repository }}:{{ .Values.registry.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+          - /bin/registry
+          - serve
+          - /etc/docker/registry/config.yml
+          {{- with .Values.registry.resources }}
+          resources:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+          - containerPort: 5000
+            name: http
+            protocol: TCP
+          livenessProbe:
+            httpGet:
+{{- if .Values.tlsSecretName }}
+              scheme: HTTPS
+{{- end }}
+              path: /
+              port: 5000
+          readinessProbe:
+            httpGet:
+{{- if .Values.tlsSecretName }}
+              scheme: HTTPS
+{{- end }}
+              path: /
+              port: 5000
+          env:
+          - name: AWS_SDK_LOAD_CONFIG
+            value: "1"
+          - name: REGISTRY_HTTP_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: plural-registry-secret
+                key: haSharedSecret
+{{- if .Values.registry.persistence.deleteEnabled }}
+          - name: REGISTRY_STORAGE_DELETE_ENABLED
+            value: "true"
+{{- end }}
+          volumeMounts:
+          - name: plural-registry-config
+            mountPath: "/etc/docker/registry"
+          - name: plural-registry-aws-config
+            mountPath: "/root/.aws"
+{{- if .Values.registry.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.registry.nodeSelector | indent 8 }}
+{{- end }}
+      {{- with .Values.registry.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.registry.tolerations | indent 8 }}
+{{- end }}
+      {{- with .Values.registry.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      - name: plural-registry-config
+        configMap:
+          name: plural-registry-config
+      - name: plural-registry-aws-config
+        configMap:
+          name: plural-registry-aws-config
\ No newline at end of file
diff --git a/charts/plural/templates/runbooks.yaml b/charts/plural/templates/runbooks.yaml
new file mode 100644
index 0000000000..da8315dcd8
--- /dev/null
+++ b/charts/plural/templates/runbooks.yaml
@@ -0,0 +1,139 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: Runbook
+metadata:
+  name: db-scaling
+  labels:
+    platform.plural.sh/pinned: 'true'
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: Postgres Scaling
+  description: overview of how to accurately scale plural's postgres instance
+  alerts:
+  - name: PluralDbCPU
+  - name: PluralDbMEM
+  display: |-
+{{ .Files.Get "runbooks/db-scaling-manual.xml" | indent 4 }}
+  datasources:
+  - name: cpu
+    type: prometheus
+    prometheus:
+      format: cpu
+      legend: $pod
+      query: sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"}[5m])) by (pod)
+  - name: memory
+    type: prometheus
+    prometheus:
+      format: memory
+      legend: $pod
+      query: sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-plural-[0-9]+"}) by (pod)
+  - name: volume
+    type: prometheus
+    prometheus:
+      format: none
+      legend: $persistentvolumeclaim
+      query: (kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-plural-.*"} - kubelet_volume_stats_available_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-plural-.*"}) / kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-plural-.*"}
+  - name: statefulset
+    type: kubernetes
+    kubernetes:
+      resource: statefulset
+      name: plural-plural
+  - name: nodes
+    type: nodes
+  actions:
+  - name: scale
+    action: config
+    redirectTo: '/'
+    configuration:
+      updates:
+      - path: 
+        - plural
+        - postgres
+        - plural
+        - resources
+        - requests
+        - cpu
+        valueFrom: cpu
+      - path:
+        - plural
+        - postgres
+        - plural
+        - resources
+        - requests
+        - memory
+        valueFrom: memory
+      - path:
+        - plural
+        - postgres
+        - plural
+        - size
+        valueFrom: volume
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: Runbook
+metadata:
+  name: hydra-db-scaling
+  labels:
+    platform.plural.sh/pinned: 'true'
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  name: Hydra Postgres Scaling
+  description: overview of how to accurately scale hydra's postgres instance
+  alerts:
+  - name: PluralHydraCPU
+  - name: PluralHydraMEM
+  display: |-
+{{ .Files.Get "runbooks/db-scaling-manual.xml" | indent 4 }}
+  datasources:
+  - name: cpu
+    type: prometheus
+    prometheus:
+      format: cpu
+      legend: $pod
+      query: sum(rate(container_cpu_usage_seconds_total{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"}[5m])) by (pod)
+  - name: memory
+    type: prometheus
+    prometheus:
+      format: memory
+      legend: $pod
+      query: sum(container_memory_working_set_bytes{namespace="{{ .Release.Namespace }}",pod=~"plural-hydra-[0-9]+"}) by (pod)
+  - name: statefulset
+    type: kubernetes
+    kubernetes:
+      resource: statefulset
+      name: plural-hydra
+  - name: nodes
+    type: nodes
+  - name: volume
+    type: prometheus
+    prometheus:
+      format: none
+      legend: $persistentvolumeclaim
+      query: (kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-hydra-.*"} - kubelet_volume_stats_available_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-hydra-.*"}) / kubelet_volume_stats_capacity_bytes{namespace="{{ .Release.Namespace }}", persistentvolumeclaim=~"pgdata-plural-hydra-.*"}
+  actions:
+  - name: scale
+    action: config
+    redirectTo: '/'
+    configuration:
+      updates:
+      - path: 
+        - plural
+        - postgres
+        - hydra
+        - resources
+        - requests
+        - cpu
+        valueFrom: cpu
+      - path:
+        - plural
+        - postgres
+        - hydra
+        - resources
+        - requests
+        - memory
+        valueFrom: memory
+      - path:
+        - plural
+        - postgres
+        - hydra
+        - size
+        valueFrom: volume
\ No newline at end of file
diff --git a/charts/plural/templates/secrets.yaml b/charts/plural/templates/secrets.yaml
new file mode 100644
index 0000000000..a0c017c1cb
--- /dev/null
+++ b/charts/plural/templates/secrets.yaml
@@ -0,0 +1,131 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-env
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+type: Opaque
+data:
+  AWS_REGION: {{ .Values.region | b64enc | quote }}
+  PROVIDER: {{ .Values.provider | b64enc | quote }}
+  BUCKET: {{ .Values.api.bucket | b64enc | quote }}
+  DKR_DNS: {{ .Values.ingress.dkr_dns | b64enc | quote }}
+  JWT_SECRET: {{ .Values.secrets.jwt | b64enc | quote }}
+  SECRET_KEY_BASE: {{ .Values.secrets.key_base | default (randAlphaNum 24) | b64enc | quote }}
+  ERLANG_COOKIE: {{ .Values.secrets.erlang | b64enc | quote }}
+  JWT_PRIVATE_KEY: {{ .Values.secrets.jwt_pk | b64enc | quote }}
+  JWT_CERT: {{ .Values.secrets.jwt_cert | b64enc | quote }}
+  JWT_ISS: {{ .Values.secrets.jwt_iss | b64enc | quote }}
+  JWT_AUD: {{ .Values.secrets.jwt_aud | b64enc | quote }}
+  AES_KEY: {{ .Values.secrets.aes_key | b64enc | quote }}
+  OPENAI_BEARER_TOKEN: {{ .Values.secrets.openai_token | default "" | b64enc | quote }}
+{{ if .Values.secrets.stripe_secret }}
+  STRIPE_SECRET: {{ .Values.secrets.stripe_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.stripe_webhook_secret }}
+  STRIPE_WEBHOOK_SECRET: {{ .Values.secrets.stripe_webhook_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.stripe_connect_id }}
+  STRIPE_CONNECT_ID: {{ .Values.secrets.stripe_connect_id | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.stripe_publishable_key }}
+  STRIPE_PUBLISHABLE_KEY: {{ .Values.secrets.stripe_publishable_key | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.sendgrid_secret }}
+  SENGRID_API_KEY: {{ .Values.secrets.sendgrid_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.zoom_client_id }}
+  ZOOM_CLIENT_ID: {{ .Values.secrets.zoom_client_id | b64enc | quote }}
+  ZOOM_CLIENT_SECRET: {{ .Values.secrets.zoom_client_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.cloudflare_token }}
+  CLOUDFLARE_AUTH_TOKEN: {{ .Values.secrets.cloudflare_token | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.cloudflare_zone }}
+  CLOUDFLARE_ZONE: {{ .Values.secrets.cloudflare_zone | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.zerossl_access_key }}
+  ZEROSSL_ACCESS_KEY: {{ .Values.secrets.zerossl_access_key | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.github }}
+  GITHUB_CLIENT_ID: {{ .Values.secrets.github.client_id | b64enc | quote }}
+  GITHUB_CLIENT_SECRET: {{ .Values.secrets.github.client_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.gitlab }}
+  GITLAB_CLIENT_ID: {{ .Values.secrets.gitlab.client_id | b64enc | quote }}
+  GITLAB_CLIENT_SECRET: {{ .Values.secrets.gitlab.client_secret | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.google }}
+  GOOGLE_CLIENT_ID: {{ .Values.secrets.google.client_id | b64enc | quote }}
+  GOOGLE_CLIENT_SECRET: {{ .Values.secrets.google.client_secret | b64enc | quote }}
+{{ if .Values.secrets.google.org_id }}
+  GCP_ORG_ID: {{ .Values.secrets.google.org_id | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.google.gcp_credentials }}
+  GCP_CREDENTIALS: {{ .Values.secrets.google.gcp_credentials | b64enc | quote }}
+{{ end }}
+{{ end }}
+{{ if .Values.secrets.workos }}
+  WORKOS_CLIENT_ID: {{ .Values.secrets.workos.client_id | b64enc | quote }}
+  WORKOS_API_KEY: {{ .Values.secrets.workos.api_key | b64enc | quote }}
+{{ if .Values.secrets.workos.webhook_secret }}
+  WORKOS_WEBHOOK_SECRET: {{ .Values.secrets.workos.webhook_secret | b64enc | quote }}
+{{ end }}
+{{ end }}
+{{ if .Values.secrets.cloud_shell_img }}
+  CLOUD_SHELL_IMG: {{ .Values.secrets.cloud_shell_img | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.github_demo_token }}
+  GITHUB_DEMO_TOKEN: {{ .Values.secrets.github_demo_token | b64enc | quote }}
+{{ end }}
+{{ range $key, $value := .Values.extraSecretEnv }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+{{ end }}
+{{ if .Values.secrets.cloud }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plrl-cloud-config
+stringData:
+  cockroaches: {{ toJson .Values.secrets.cloud.cockroaches | quote }}
+{{ end }}
+{{ if .Values.admin.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-migration-env
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+type: Opaque
+data:
+  ADMIN_EMAIL: {{ .Values.admin.email | b64enc | quote }}
+  ADMIN_NAME: {{ .Values.admin.name | b64enc | quote }}
+  ADMIN_PASSWORD: {{ .Values.admin.password | b64enc | quote }}
+  PUBLISHER_NAME: {{ .Values.admin.publisher | b64enc | quote }}
+  PUBLISHER_DESCRIPTION: {{ .Values.admin.publisher_description | b64enc | quote }}
+{{ end }}
+{{ if .Values.hydraPassword }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hydra.plural-hydra.credentials.postgresql.acid.zalan.do
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+stringData:
+  username: hydra
+  password: {{ .Values.hydraPassword }}
+{{ end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plural-hydra
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+stringData:
+  secretsSystem: {{ .Values.hydraSecrets.system | quote }}
+  secretsCookie: {{ .Values.hydraSecrets.cookie | quote }}
+  dsn: {{ .Values.hydraSecrets.dsn | quote }}
diff --git a/charts/plural/templates/secretsyncs.yaml b/charts/plural/templates/secretsyncs.yaml
new file mode 100644
index 0000000000..35b14da2f6
--- /dev/null
+++ b/charts/plural/templates/secretsyncs.yaml
@@ -0,0 +1,15 @@
+apiVersion: platform.plural.sh/v1alpha1
+kind: SecretSync
+metadata:
+  name: rabbitmq-password
+spec:
+  name: rabbitmq-default-user
+  namespace: {{ .Values.rabbitmqNamespace }}
+---
+apiVersion: platform.plural.sh/v1alpha1
+kind: SecretSync
+metadata:
+  name: influxdb-auth 
+spec:
+  name: influxdb-auth
+  namespace: {{ .Values.influxNamespace }}
\ No newline at end of file
diff --git a/charts/plural/templates/service.yaml b/charts/plural/templates/service.yaml
new file mode 100644
index 0000000000..1b9db2aa23
--- /dev/null
+++ b/charts/plural/templates/service.yaml
@@ -0,0 +1,117 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-api
+  labels:
+    app: plural-api
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: {{ .Values.api.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  - port: 4369
+    targetPort: epmd
+    protocol: TCP
+    name: epmd
+  selector:
+    app.kubernetes.io/name: plural-api
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-mcp
+  {{ if .Values.service.mcp.annotations }}
+  annotations: {{ toYaml .Values.service.mcp.annotations | nindent 4 }}
+  {{ end }}
+  labels:
+    app: plural-mcp
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: {{ .Values.service.mcp.type }}
+  ports:
+  - port: {{ .Values.mcp.port }}
+    targetPort: mcp
+    protocol: TCP
+    name: mcp
+  selector:
+    app.kubernetes.io/name: plural-mcp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-rtc
+  labels:
+    app: plural-rtc
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: {{ .Values.api.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  - port: 4369
+    targetPort: epmd
+    protocol: TCP
+    name: epmd
+  selector:
+    app.kubernetes.io/name: plural-rtc
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: chartmuseum
+  labels:
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: 8080
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: chartmuseum
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-www
+  labels:
+    app: plural-www
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: {{ .Values.www.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: plural-www
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plural-registry
+  labels:
+    app: plural-registry
+{{ include "plural.labels" . | indent 4 }}
+spec:
+  type: NodePort
+  ports:
+  - port: 5000
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: plural-registry
+    app.kubernetes.io/instance: {{ .Release.Name }}
\ No newline at end of file
diff --git a/charts/plural/values.yaml b/charts/plural/values.yaml
new file mode 100644
index 0000000000..0e1d097bf3
--- /dev/null
+++ b/charts/plural/values.yaml
@@ -0,0 +1,506 @@
+global:
+  registry: dkr.plural.sh/plural
+  tag: ~
+
+replicaCount: 3
+rabbitmqNamespace: rabbitmq
+influxNamespace: influx
+
+extraSecretEnv: {}
+
+rbac:
+  serviceAccountAnnotations: {}
+
+configOverlays: []
+
+secrets:
+  jwt: dummy
+  erlang: dummy
+  jwt_pk: dummy
+  jwt_cert: dummy
+  jwt_iss: dummy
+  jwt_aud: dummy
+  aes_key: dummy
+
+admin:
+  enabled: false
+
+postgres:
+  create: true
+  plural:
+    resources: {}
+    size: 50Gi
+    tolerations:
+    - key: plural.sh/pluralReserved
+      operator: Exists
+      effect: "NoSchedule"
+
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+  hydra:
+    resources: {}
+    size: 25Gi
+    tolerations:
+    - key: plural.sh/pluralReserved
+      operator: Exists
+      effect: "NoSchedule"
+
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+  default:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+      limits:
+        cpu: '2'
+        memory: 1Gi
+
+
+api:
+  port: 4000
+  bucket: plural-assets
+  resources: {}
+
+  topologySpreadConstraints: []
+
+mcp:
+  port: 3000
+
+image:
+  repository: plural
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  pullPolicy: IfNotPresent
+
+rtc:
+  repository: rtc
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  resources: {}
+  replicaCount: 3
+
+  topologySpreadConstraints: []
+
+worker:
+  repository: worker
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  minReplicas: 1
+  maxReplicas: 10
+  resources: {}
+  replicaCount: 3
+
+  dockerScan:
+    pollInterval: 60
+    parallelism: 1
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: plural-worker
+        app.kubernetes.io/instance: plural
+
+  nodeSelector: {}
+
+  extraEnv: []
+
+  tolerations:
+  - key: plural.sh/pluralReserved
+    operator: Exists
+    effect: "NoSchedule"
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-worker-medium
+
+ai:
+  repository: plural-ai
+  tag: ~
+  port: 8000
+  replicaCount: 2
+  resources: {}
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 50
+    cpuUtilization: 80
+
+www:
+  repository: plural-www
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+  port: 8080
+  resources: {}
+  replicaCount: 3
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: plural-www
+        app.kubernetes.io/instance: plural
+
+cron:
+  repository: cron
+  # if empty the chart version is used
+  tag: '' ## PLRL-REPLACE[  tag: '%s']
+
+imagePullSecrets:
+- name: plural-creds
+
+provider: aws
+region: us-east-1
+
+dbPasswordSecret: plural.plural-plural.credentials.postgresql.acid.zalan.do
+rabbitPasswordSecret: plural-rabbitmq
+
+crons:
+- cronName: plrl-login-prune
+  cronModule: Prune.Passwordless
+  crontab: "10 0 * * *"
+  envVars: []
+- cronName: plrl-prune-queues
+  cronModule: Prune.Queues
+  crontab: "15 */3 * * *"
+  envVars: []
+- cronName: plrl-stale-tests
+  cronModule: Task.StaleTests
+  crontab: "30 0 * * *"
+  envVars: []
+- cronName: plrl-prune-invites
+  cronModule: Prune.Invites
+  crontab: "45 0 * * *"
+  envVars: []
+- cronName: plrl-prune-stacks
+  cronModule: Prune.Stacks
+  crontab: "55 0 * * *"
+  envVars: []
+- cronName: plrl-prune-trials
+  cronModule: Prune.Trials
+  cronTab: "40 0 * * *"
+  envVars: []
+- cronName: plrl-prune-notifs
+  cronModule: Prune.Notifications
+  cronTab: "15 1 * * *"
+  envVars: []
+- cronName: plrl-metering
+  cronModule: Task.Metering
+  cronTab: "30 1 * * *"
+  envVars: []
+- cronName: plrl-digest
+  cronModule: Digest.Pending
+  cronTab: "0 12 * * 1"
+  envVars: []
+- cronName: plrl-prune-cloud-instances
+  cronModule: Prune.Cloud
+  cronTab: "45 1 * * *"
+  envVars: []
+
+hydraSecrets:
+  dsn: memory
+  system: dummy
+  cookie: dummy
+
+autoscaling:
+  enabled: true
+
+hydra:
+  replicaCount: 2
+
+  image:
+    repository: gcr.io/pluralsh/oryd/hydra
+    tag: v2.0.3
+  
+  secret:
+    enabled: false
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+
+  maester:
+    enabled: false
+  hydra:
+    dev: false
+    automigration:
+      enabled: false
+    config:
+      serve:
+        admin:
+          tls:
+            enabled: false
+        public:
+          tls:
+            enabled: false
+        cookies:
+          same_site_mode: None
+          secure: true
+      ttl:
+        id_token: 12h
+        access_token: 12h
+        refresh_token: 96h
+
+  pdb:
+    enabled: true
+  deployment:
+    autoscaling:
+      enabled: false
+    tolerations:
+    - key: plural.sh/pluralReserved
+      operator: Exists
+      effect: "NoSchedule"
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: DoNotSchedule
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: hydra
+          app.kubernetes.io/instance: plural
+    
+  ingress:
+    public:
+      enabled: true
+      annotations:
+        kubernetes.io/tls-acme: "true"
+        kubernetes.io/ingress.class: "nginx"
+        cert-manager.io/cluster-issuer: letsencrypt-prod
+        nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
+        nginx.ingress.kubernetes.io/use-regex: "true"
+        nginx.ingress.kubernetes.io/proxy-connect-timeout: '10'
+        nginx.ingress.kubernetes.io/proxy-read-timeout: '120'
+        nginx.ingress.kubernetes.io/proxy-send-timeout: '120'
+  
+chartmuseum:
+  resources: {}
+  replicaCount: 2
+  rbac:
+    serviceAccountAnnotations: {}
+  repository: dkr.plural.sh/plural/chartmuseum
+  tag: v0.13.2
+  bucket: plural-charts
+  pullPolicy: Always
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: chartmuseum
+        app.kubernetes.io/instance: plural
+
+registry:
+  replicaCount: 2
+  podAnnotations: {}
+  podLabels: {}
+  podDisruptionBudget: {}
+  nodeSelector: {}
+  tolerations:
+  - key: plural.sh/pluralReserved
+    operator: Exists
+    effect: "NoSchedule"
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: plural.sh/scalingGroup
+            operator: In
+            values:
+            - plural-small
+
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: plural-registry
+        app.kubernetes.io/instance: plural
+
+  rbac:
+    serviceAccountAnnotations: {}
+  
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  persistence:
+    accessMode: ReadWriteOnce
+    enabled: false
+    size: 10Gi
+
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    fsGroup: 1000
+
+  secrets:
+    haSharedSecret: ""
+
+  image: 
+    repository: gcr.io/pluralsh/registry
+    tag: 2.7.2
+
+  configData:
+    version: 0.1
+    notifications:
+      endpoints:
+      - name: plural
+        url: http://plural-api:4000/dkr/callback
+        timeout: 500ms
+        threshold: 5
+        backoff: 1s
+    log:
+      fields:
+        service: registry
+    storage:
+      cache:
+        blobdescriptor: inmemory
+    prometheus:
+      enabled: true
+    auth:
+      token:
+        realm: plural.piazza.app/dkr
+        service: plural.piazza.app/dkr
+        issuer: plural.piazza.app
+        rootcertbundle: /etc/docker/registry/cert.pem
+    http:
+      addr: :5000
+      headers:
+        X-Content-Type-Options: [nosniff]
+    health:
+      storagedriver:
+        enabled: true
+        interval: 10s
+        threshold: 3
+
+postgresql:
+  image:
+    registry: gcr.io
+    repository: pluralsh/postgres
+    tag: 11.7.0-debian-10-r9
+  metrics:
+    enabled: true
+    image:
+      registry: gcr.io
+      repository: pluralsh/postgres-exporter
+      tag: 0.8.0
+    serviceMonitor:
+      enabled: true
+  postgresqlExtendedConf:
+    max_connections: 100
+  postgresqlUsername: plural
+  postgresqlDatabase: plural
+
+rabbitmqCredentials:
+  namespace: "rabbitmq"
+
+rabbitmq:
+  metrics:
+    enabled: true
+
+influxdb:
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 0.2
+  env:
+  - name: INFLUXDB_DB
+    value: plural
+  setDefaultUser:
+    enabled: true
+    user:
+      username: plural
+      password: null
+
+nameOverride: ""
+fullnameOverride: ""
+
+service:
+  type: ClusterIP
+  port: 80
+
+  mcp:
+    type: ClusterIP
+    annotations: {}
+
+ingress:
+  enabled: true
+  dns: app.plural.sh
+  dkr_dns: dkr.plural.sh
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/affinity: cookie
+    nginx.ingress.kubernetes.io/session-cookie-path: /socket
+    nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
+    nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
+  
+  mcp:
+    enabled: false
+    dns: mcp.plural.sh
+    annotations:
+      kubernetes.io/tls-acme: "true"
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+      nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
+
+resources: {}
+
+nodeSelector: {}
+
+tolerations:
+- key: plural.sh/pluralReserved
+  operator: Exists
+  effect: "NoSchedule"
+
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: plural.sh/scalingGroup
+          operator: In
+          values:
+          - plural-small
+
+test-base:
+  enabled: false
+  application: plural
+  testName: plural-integration
+  promoteTag: stable
\ No newline at end of file
diff --git a/charts/plural/values.yaml.tpl b/charts/plural/values.yaml.tpl
new file mode 100644
index 0000000000..de31dd6573
--- /dev/null
+++ b/charts/plural/values.yaml.tpl
@@ -0,0 +1,101 @@
+postgresql:
+  postgresqlPassword: {{ dedupe . "plural.postgresql.postgresqlPassword" (randAlphaNum 14) }}
+  postgresqlPostgresPassword: {{ dedupe . "plural.postgresql.postgresqlPostgresPassword" (randAlphaNum 14) }}
+
+influxdb:
+  setDefaultUser:
+    user:
+      password: {{ dedupe . "plural.influxdb.setDefaultUser.user.password" (randAlphaNum 26) }}
+
+provider: {{ .Provider }}
+region: {{ .Region }}
+
+rabbitmqNamespace: {{ namespace "rabbitmq" }}
+influxNamespace: {{ namespace "influx" }}
+
+rbac:
+  serviceAccountAnnotations:
+    eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-plural"
+
+registry:
+  rbac:
+    serviceAccountAnnotations:
+      eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-plural"
+  configData:
+    storage:
+      {{ if eq .Provider "google" }}
+      gcs:
+        bucket: {{ .Values.images_bucket }}
+      {{ end }}
+      {{ if eq .Provider "aws" }}
+      s3:
+        region: {{ .Region }}
+        bucket: {{ .Values.images_bucket }}
+      {{ end }}
+    auth:
+      token:
+        realm: https://{{ .Values.plural_dns }}/auth/token
+        service: {{ .Values.plural_dkr_dns }}
+        issuer: {{ .Values.plural_dns }}
+
+{{ $certificate := genCA "plural" 1886 }}
+
+secrets:
+  jwt: {{ dedupe . "plural.secrets.jwt" (randAlphaNum 14) }}
+  erlang: {{ dedupe . "plural.secrets.erlang" (randAlphaNum 14) }}
+  jwt_pk: {{ dedupe . "plural.secrets.jwt_pk" $certificate.Key | quote }}
+  jwt_cert: {{ dedupe . "plural.secrets.jwt_cert" $certificate.Cert | quote }}
+  jwt_aud: {{ .Values.plural_dkr_dns }}
+  jwt_iss: {{ .Values.plural_dns }}
+  aes_key: {{ dedupe . "plural.secrets.aes_key" genAESKey }}
+
+admin:
+  enabled: true
+  name: {{ .Values.admin_name }}
+  email: {{ .Values.admin_email }}
+  password: {{ dedupe . "plural.admin.password" (randAlphaNum 14) }}
+  publisher: {{ .Values.publisher }}
+  publisher_description: {{ .Values.publisher_description }}
+
+ingress:
+  dns: {{ .Values.plural_dns }}
+  dkr_dns: {{ .Values.plural_dkr_dns }}
+
+api:
+  bucket: {{ .Values.assets_bucket }}
+
+chartmuseum:
+  bucket: {{ .Values.chartmuseum_bucket }}
+  rbac:
+    serviceAccountAnnotations:
+      eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-plural"
+
+{{ $hydraPassword := dedupe . "plural.hydraPassword" (randAlphaNum 20) }}
+{{ $hydraHost := default "hydra.plural.sh" .Values.hydra_host }}
+hydraPassword: {{ $hydraPassword }}
+hydraSecrets:
+  system: {{ dedupe . "plural.hydraSecrets.system" (randAlphaNum 20) }}
+  cookie: {{ dedupe . "plural.hydraSecrets.cookie" (randAlphaNum 20) }}
+  dsn: "postgres://hydra:{{ $hydraPassword }}@plural-hydra:5432/hydra"
+
+hydra:
+  hydra:
+    config:
+      urls:
+        self:
+          issuer: https://{{ $hydraHost }}/
+        login: https://{{ .Values.plural_dns }}/login
+        consent: https://{{ .Values.plural_dns }}/oauth/consent
+  ingress:
+    public:
+      hosts:
+      - host: {{ $hydraHost }}
+        paths:
+        - path: /*
+          pathType: ImplementationSpecific
+      tls:
+      - hosts:
+        - {{ $hydraHost }}
+        secretName: hydra-tls
+      
+license: {{ .License | quote }}

From babd2e5ec4639ee8590e50849d27f9104073ef6c Mon Sep 17 00:00:00 2001
From: michaeljguarino <mjg@plural.sh>
Date: Wed, 8 Apr 2026 23:20:24 -0400
Subject: [PATCH 2/2] add charts to action

---
 .github/workflows/chart.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/chart.yaml b/.github/workflows/chart.yaml
index 21a9a4142e..35522057aa 100644
--- a/.github/workflows/chart.yaml
+++ b/.github/workflows/chart.yaml
@@ -31,6 +31,8 @@ jobs:
           helm repo add fluxcd-community https://fluxcd-community.github.io/helm-charts
           helm repo add dexidp https://charts.dexidp.io
           helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add plural https://pluralsh.github.io/module-library
+          helm repo add plural https://k8s.ory.sh/helm/charts
       - name: Run chart-releaser
         id: release
         uses: helm/chart-releaser-action@v1.5.0