Add OpenEBS v4.6.1 with images repointed to ghcr.io/wrktalk-tech - Loki and Alloy disabled

2026-10-01 13:22:53 +05:30
commit a14a568465
912 changed files with 135387 additions and 0 deletions
@@ -0,0 +1,4 @@
+OpenEBS Mayastor has been installed. Check its status by running:
+$ kubectl get pods -n {{ .Release.Namespace }}
+
+For more information or to view the documentation, visit our website at https://openebs.io/docs/.
@@ -0,0 +1,767 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Renders a value that contains template.
+Usage:
+{{ include "render" ( dict "value" .Values.path.to.the.Value "context" $) }}
+*/}}
+{{- define "render" -}}
+    {{- if typeIs "string" .value }}
+        {{- tpl .value .context }}
+    {{- else }}
+        {{- tpl (.value | toYaml) .context }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Renders the CORE server init container, if enabled
+Usage:
+{{ include "base_init_core_containers" . }}
+*/}}
+{{- define "base_init_core_containers" -}}
+    {{- if .Values.base.initCoreContainers.enabled }}
+    {{- include "render_init_containers" (dict "value" .Values.base.initCoreContainers.containers "context" $) | nindent 8 }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Renders the HA NODE AGENT init container, if enabled
+Usage:
+{{ include "base_init_ha_node_containers" . }}
+*/}}
+{{- define "base_init_ha_node_containers" -}}
+    {{- if .Values.base.initHaNodeContainers.enabled }}
+    {{- include "render_init_containers" (dict "value" .Values.base.initHaNodeContainers.containers "context" $) | nindent 8 }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Renders the base init containers for all deployments, if any
+Usage:
+{{ include "base_init_containers" . }}
+*/}}
+{{- define "base_init_containers" -}}
+    {{- if .Values.base.initContainers.enabled }}
+    {{- include "render_init_containers" (dict "value" .Values.base.initContainers.containers "context" $) | nindent 8 }}
+    {{- end }}
+    {{- include "jaeger_collector_init_container" . }}
+{{- end -}}
+
+{{/*
+Renders the jaeger agent init container, if enabled
+Usage:
+{{ include "jaeger_collector_init_container" . }}
+*/}}
+{{- define "jaeger_collector_init_container" -}}
+    {{- if .Values.base.jaeger.enabled }}
+      {{- if .Values.base.jaeger.initContainer }}
+      {{- if .Values.base.jaeger.collector }}
+      {{- include "render_init_containers" (dict "value" .Values.base.jaeger.collector.initContainer "context" $) | nindent 8 }}
+      {{- else }}
+        - name: jaeger-probe
+          image: busybox:latest
+          command: [ 'sh', '-c', 'trap "exit 1" TERM; until nc -vzw 5 -u jaeger-collector:4317; do date; echo "Waiting for jaeger..."; sleep 1; done;' ]
+      {{- end }}
+      {{- end }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Renders the csi node init containers, if enabled
+Usage:
+{{ include "csi_node_init_containers" . }}
+*/}}
+{{- define "csi_node_init_containers" -}}
+    {{- if (.Values.csi.node.initContainers).enabled }}
+    {{- include "render_init_containers" (dict "value" .Values.csi.node.initContainers.containers "context" $) | nindent 8 }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Renders the base image pull secrets for all deployments, if any
+Usage:
+{{ include "base_pull_secrets" . }}
+*/}}
+{{- define "base_pull_secrets" -}}
+    {{- if (not (empty .Values.global.imagePullSecrets)) }}
+        {{- range .Values.global.imagePullSecrets | uniq -}}
+            {{- if kindIs "map" . -}}
+            {{ nindent 8 "- name:" }} {{ .name }}
+            {{- else -}}
+            {{ nindent 8 "- name:" }} {{ . }}
+            {{- end }}
+        {{- end }}
+    {{- else if (not (empty .Values.image.pullSecrets)) }}
+        {{- range .Values.image.pullSecrets | uniq -}}
+            {{- if kindIs "map" . -}}
+            {{ nindent 8 "- name:" }} {{ .name }}
+            {{- else -}}
+            {{ nindent 8 "- name:" }} {{ . }}
+            {{- end }}
+        {{- end }}
+    {{- else -}}
+        {{- if .Values.base.imagePullSecrets }}
+            {{- if .Values.base.imagePullSecrets.enabled }}
+                {{- if (empty .Values.base.imagePullSecrets.secrets) }}
+                    {{ nindent 8 "- name: login" }}
+                {{- else -}}
+                    {{- include "render" (dict "value" .Values.base.imagePullSecrets.secrets "context" $) | nindent 8 }}
+                {{- end}}
+            {{- end }}
+        {{- end }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Concatenates imagepullsecrets for preupgradehook and handles different formats (example - secret or - name: secret)
+*/}}
+{{- define "mayastor.preUpgradeHook.pullSecrets" -}}
+{{- $names := list -}}
+{{- with .Values.global.imagePullSecrets -}}
+  {{- range . -}}
+    {{- if kindIs "map" . }}
+      {{- if and (hasKey . "name") (not (empty .name)) -}}
+        {{ $names = append $names .name }}
+      {{- end -}}
+    {{- else if not (empty .) -}}
+      {{ $names = append $names . -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+{{- with .Values.preUpgradeHook.imagePullSecrets -}}
+  {{- range . }}
+    {{- if kindIs "map" . -}}
+      {{- if and (hasKey . "name") (not (empty .name)) -}}
+        {{- $names = append $names .name }}
+      {{- end -}}
+    {{- else if not (empty .) -}}
+      {{- $names = append $names . -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+{{- $names = uniq $names -}}
+{{- if $names -}}
+  {{- range $names }}
+- name: {{ . }}
+  {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Renders the REST server init container, if enabled
+Usage:
+{{- include "rest_agent_init_container" . }}
+*/}}
+{{- define "rest_agent_init_container" -}}
+    {{- if .Values.base.initRestContainer.enabled }}
+    {{- include "render_init_containers" (dict "value" .Values.base.initRestContainer.initContainer "context" $) | nindent 8 }}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Renders the jaeger scheduling rules, if any
+Usage:
+{{ include "jaeger_scheduling" . }}
+*/}}
+{{- define "jaeger_scheduling" -}}
+    {{- if index .Values "jaeger-operator" "affinity" }}
+  affinity:
+    {{- include "render" (dict "value" (index .Values "jaeger-operator" "affinity") "context" $) | nindent 4 }}
+    {{- end }}
+    {{- if index .Values "jaeger-operator" "tolerations" }}
+  tolerations:
+    {{- include "render" (dict "value" (index .Values "jaeger-operator" "tolerations") "context" $) | nindent 4 }}
+    {{- end }}
+{{- end -}}
+
+{{/* Generate Core list specification (-l param of io-engine) */}}
+{{- define "cpuFlag" -}}
+{{- include "coreListUniq" . -}}
+{{- end -}}
+
+{{/* Get the number of cores from the coreList */}}
+{{- define "coreCount" -}}
+{{- include "coreListUniq" . | split "," | len -}}
+{{- end -}}
+
+{{- define "logFormat" -}}
+{{- if (regexMatch "^((json|pretty|compact))$" .Values.base.logging.format) -}}
+    {{- print .Values.base.logging.format -}}
+{{- else -}}
+    {{- fail "invalid logging format. valid values are json, pretty, compact" -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Get a list of cores as a comma-separated list */}}
+{{- define "coreListUniq" -}}
+{{- if .Values.io_engine.coreList -}}
+{{- $cores_pre := .Values.io_engine.coreList -}}
+{{- if not (kindIs "slice" .Values.io_engine.coreList) -}}
+{{- $cores_pre = list $cores_pre -}}
+{{- end -}}
+{{- $cores := list -}}
+{{- range $index, $value := $cores_pre | uniq -}}
+{{- $value = $value | toString | replace " " "" }}
+{{- if eq ($value | int | toString) $value -}}
+{{-   $cores = append $cores $value -}}
+{{- end -}}
+{{- end -}}
+{{- $first := first $cores | required (print "At least one core must be specified in io_engine.coreList") -}}
+{{- $cores | join "," -}}
+{{- else -}}
+{{- if gt 1 (.Values.io_engine.cpuCount | int) -}}
+{{- fail ".Values.io_engine.cpuCount must be >= 1" -}}
+{{- end -}}
+{{- untilStep 1 (add 1 .Values.io_engine.cpuCount | int) 1 | join "," -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Adds the project domain to labels
+Usage:
+{{ include "label_prefix" . }}/release: {{ .Release.Name }}
+*/}}
+{{- define "label_prefix" -}}
+    {{ $product := .Files.Get "product.yaml" | fromYaml }}
+    {{- print $product.domain -}}
+{{- end -}}
+
+{{/*
+Creates the tolerations based on the global and component wise tolerations, with early eviction
+Usage:
+{{ include "_tolerations_with_early_eviction" (dict "template" . "localTolerations" .Values.path.to.local.tolerations) }}
+*/}}
+{{- define "_tolerations_with_early_eviction" -}}
+{{- toYaml .template.Values.earlyEvictionTolerations | nindent 8 }}
+{{- if .localTolerations }}
+    {{- toYaml .localTolerations | nindent 8 }}
+{{- else if .template.Values.tolerations }}
+    {{- toYaml .template.Values.tolerations | nindent 8 }}
+{{- end }}
+{{- end }}
+
+
+{{/*
+Creates the tolerations based on the global and component wise tolerations
+Usage:
+{{ include "tolerations" (dict "template" . "localTolerations" .Values.path.to.local.tolerations) }}
+*/}}
+{{- define "tolerations" -}}
+{{- if .localTolerations }}
+    {{- toYaml .localTolerations | nindent 8 }}
+{{- else if .template.Values.tolerations }}
+    {{- toYaml .template.Values.tolerations | nindent 8 }}
+{{- end }}
+{{- end }}
+
+{{/*
+Creates the node selector based on the global and component wise node selectors
+Usage:
+{{ include "node_selector" (dict "template" . "localNodeSelector" .Values.path.to.local.nodeSelector) }}
+*/}}
+{{- define "node_selector" -}}
+{{- if .localNodeSelector }}
+    {{- toYaml .localNodeSelector | nindent 8 }}
+{{- else if .template.Values.nodeSelector }}
+    {{- toYaml .template.Values.nodeSelector | nindent 8 }}
+{{- end }}
+{{- end }}
+
+{{/*
+Generates the priority class name, with the given `template` and the `localPriorityClass`
+Usage:
+{{ include "priority_class" (dict "template" . "localPriorityClass" .Values.path.to.local.priorityClassName) }}
+*/}}
+{{- define "priority_class" -}}
+    {{- if typeIs "string" .localPriorityClass }}
+        {{- if .localPriorityClass -}}
+            {{ printf "%s" .localPriorityClass -}}
+        {{- else if .template.Values.priorityClassName -}}
+            {{ printf "%s" .template.Values.priorityClassName -}}
+        {{- else -}}
+            {{ printf "" -}}
+        {{- end -}}
+    {{- end -}}
+{{- end -}}
+
+
+{{/*
+Generates the priority class name, with the given `template` and the `localPriorityClass`, sets to mayastor default priority class
+if both are empty
+Usage:
+{{ include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.path.to.local.priorityClassName) }}
+*/}}
+{{- define "priority_class_with_default" -}}
+    {{- if typeIs "string" .localPriorityClass }}
+        {{- if .localPriorityClass -}}
+            {{ printf "%s" .localPriorityClass -}}
+        {{- else if .template.Values.priorityClassName -}}
+            {{ printf "%s" .template.Values.priorityClassName -}}
+        {{- else -}}
+            {{ printf "%s-cluster-critical" .template.Release.Name -}}
+        {{- end -}}
+    {{- end -}}
+{{- end -}}
+
+{{/*
+    Generate the default StorageClass parameters.
+    This is required because StorageClass parameters cannot be patched after creation.
+    If the StorageClass already exists, the default StorageClass carries the parameters and values
+    of that StorageClass. Else, it carries the default parameters and values.
+*/}}
+{{- define "storageClass.parameters" -}}
+    {{- $scName := index . 0 -}}
+    {{- $valuesParams := index . 1 -}}
+
+    {{/* Check to see if a default StorageClass already exists */}}
+    {{- $sc := lookup "storage.k8s.io/v1" "StorageClass" "" $scName -}}
+
+    {{- if $sc -}}
+        {{/* Existing defaults */}}
+        {{ range $param, $val := $sc.parameters }}
+{{ $param | quote }}: {{ $val | quote }}
+        {{- end -}}
+
+    {{- else -}}
+        {{/* Current defaults */}}
+        {{ range $param, $val := $valuesParams }}
+{{ $param | quote }}: {{ $val | quote }}
+        {{- end -}}
+    {{- end -}}
+{{- end -}}
+
+{{/*
+Adds the image prefix to image name
+*/}}
+{{- define "image_prefix" -}}
+    {{ $product := .Files.Get "product.yaml" | fromYaml }}
+    {{- print $product.imagePrefix -}}
+{{- end -}}
+
+{{/*
+Get the Jaeger URL
+*/}}
+{{- define "jaeger_url" -}}
+    {{- if $collector := .Values.base.jaeger.collector }}
+        {{- $collector.name }}:{{ $collector.port }}
+    {{- else }}
+        {{- print "jaeger-collector:4317" -}}
+    {{- end }}
+{{- end -}}
+
+{{/*
+ Create a normalized etcd name based on input parameters
+ */}}
+{{- define "etcdUrl" -}}
+    {{- if eq (.Values.etcd.enabled) false }}
+        {{- if .Values.etcd.externalUrl }}
+            {{- .Values.etcd.externalUrl }}
+        {{- else }}
+          {{- fail "etcd.externalUrl must be set" }}
+        {{- end }}
+    {{- else }}
+        {{- .Release.Name }}-etcd:{{ .Values.etcd.service.ports.client }}
+    {{- end }}
+{{- end }}
+
+{{/*
+ Check if etcd is explicitly enabled/disabled or implicitly enabled (for upgrades where enabled key was absent)
+ */}}
+{{- define "etcdEnabled" -}}
+    {{- if eq (.Values.etcd.enabled) false }}
+        {{- "false" -}}
+    {{- else if eq (.Values.etcd.enabled) true }}
+        {{- "true" -}}
+    {{- else if .Values.etcd.externalUrl }}
+        {{- "false" -}}
+    {{- else }}
+        {{- "true" -}}
+    {{- end }}
+{{- end }}
+
+{{/*
+Renders init containers. If unset it sets the container image.
+*/}}
+{{- define "render_init_containers" -}}
+    {{- $containers := list }}
+    {{- $image := .context.Values.base.initContainers.image }}
+    {{- $values_image := .context.Values.image }}
+    {{- $global := .context.Values.global }}
+    {{- $ctx := .context }}
+    {{- range .value -}}
+        {{ $container := deepCopy . }}
+        {{- if hasKey $container "command" }}
+          {{- $renderedCmd := list }}
+            {{- range $container.command }}
+              {{- $renderedCmd = append $renderedCmd (tpl . $ctx) }}
+            {{- end }}
+           {{- $_ := set $container "command" $renderedCmd }}
+        {{- end }}
+        {{- if not (hasKey $container "imagePullPolicy") }}
+            {{- $pullPolicy := $global.imagePullPolicy | default $image.pullPolicy | default $values_image.pullPolicy }}
+            {{- $_ := set $container "imagePullPolicy" $pullPolicy }}
+        {{- end }}
+        {{- if not (hasKey $container "image") }}
+            {{- $_ := set $container "image" (include "render_init_container_image" $ctx ) }}
+        {{- end }}
+        {{- $containers = append $containers $container }}
+    {{- end -}}
+    {{- $containers | toYaml }}
+{{- end -}}
+
+{{- define "render_init_container_image" -}}
+{{- $image := .Values.base.initContainers.image }}
+{{- $values_image := .Values.image }}
+{{- $global := .Values.global }}
+{{- $registry := $global.imageRegistry | default $image.registry | default $values_image.registry }}
+{{- $namespace := $image.namespace | default $values_image.repo }}
+{{- $name := $image.name | default "alpine-sh" }}
+{{- $tag := $image.tag | default "4.1.0" }}
+{{- printf "%s/%s/%s:%s" $registry $namespace $name $tag }}
+{{- end -}}
+
+
+{{/*
+Get the Events Jetstream Replica Count
+*/}}
+{{- define "events_replicas" -}}
+    {{- if .Values.nats.cluster.enabled }}
+        {{- min .Values.nats.cluster.replicas 3 }}
+    {{- else }}
+        {{- print "1" -}}
+    {{- end }}
+{{- end -}}
+
+{{/*
+Returns matched if the Etcd StatefulSet is of v8.6.0
+Usage:
+  {{- if include "etcd_is_8.6.0" . }}
+    Do something
+  {{- end }}
+*/}}
+{{- define "etcd_is_8.6.0" -}}
+  {{- $sts  := lookup "apps/v1" "StatefulSet" .Release.Namespace (printf "%s-etcd" .Release.Name) -}}
+  {{/*
+  If no STS exists, erring on the side of caution and assuming there is one
+  and we made a mistake in finding it --> matched
+  */}}
+  {{- if not $sts -}}
+    matched
+  {{- else -}}
+    {{- if and $sts.metadata $sts.metadata.labels -}}
+      {{/* Grab value of chart label (or default to "") */}}
+      {{- $chart_name := index $sts.metadata.labels "helm.sh/chart" | default "" -}}
+      {{/* If it’s exactly "etcd-8.6.0" --> matched */}}
+      {{- if eq $chart_name "etcd-8.6.0" -}}
+        matched
+      {{- end -}}
+    {{- else -}}
+      {{/*
+      $sts exists, but doesn't have .metadata or .metadata.labels for some reason.
+      This may happen in a dry-run due to how lookup behaves. Erring on the side of caution and matching.
+      */}}
+      matched
+    {{- end -}}
+  {{- end -}}
+{{- end }}
+
+{{/*
+Validates tls settings and fails with a clear message on invalid combinations.
+Usage: {{ include "validate_tls_mode" . }}
+*/}}
+{{- define "validate_tls_mode" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $globalTls.mutualAuth $restTls -}}
+{{- $ag := $globalTls.autoGenerated -}}
+{{- if and $globalTls.enabled (not $ag.enabled) -}}
+    {{- if not $restTls.existingSecret -}}
+        {{- fail "tls: apis.rest.security.tls.existingSecret must be set when tls.autoGenerated.enabled is false" -}}
+    {{- end -}}
+    {{- if $mutualAuth -}}
+        {{- $clients := $restTls.clients -}}
+        {{- if not $clients.csiController.existingSecret -}}
+            {{- fail "tls: apis.rest.security.tls.clients.csiController.existingSecret must be set when tls.autoGenerated.enabled is false and mutualAuth is true" -}}
+        {{- end -}}
+        {{- if not $clients.csiNode.existingSecret -}}
+            {{- fail "tls: apis.rest.security.tls.clients.csiNode.existingSecret must be set when tls.autoGenerated.enabled is false and mutualAuth is true" -}}
+        {{- end -}}
+        {{- if not $clients.callhome.existingSecret -}}
+            {{- fail "tls: apis.rest.security.tls.clients.callhome.existingSecret must be set when tls.autoGenerated.enabled is false and mutualAuth is true" -}}
+        {{- end -}}
+        {{- if not $clients.metricsExporter.existingSecret -}}
+            {{- fail "tls: apis.rest.security.tls.clients.metricsExporter.existingSecret must be set when tls.autoGenerated.enabled is false and mutualAuth is true" -}}
+        {{- end -}}
+        {{- if not $clients.diskpoolOperator.existingSecret -}}
+            {{- fail "tls: apis.rest.security.tls.clients.diskpoolOperator.existingSecret must be set when tls.autoGenerated.enabled is false and mutualAuth is true" -}}
+        {{- end -}}
+        {{- if not $clients.plugin.existingSecret -}}
+            {{- fail "tls: apis.rest.security.tls.clients.plugin.existingSecret must be set when tls.autoGenerated.enabled is false and mutualAuth is true" -}}
+        {{- end -}}
+    {{- end -}}
+{{- else -}}
+    {{- if not (has $ag.engine (list "pod" "helm" "cert-manager")) -}}
+        {{- fail (printf "tls.autoGenerated.engine must be pod, helm, or cert-manager (got: %q)" $ag.engine) -}}
+    {{- end -}}
+    {{- if and $globalTls.enabled (eq $ag.engine "pod") $mutualAuth -}}
+        {{- fail "tls: engine=pod cannot be used with mutualAuth — pod TLS uses a transient cert with no client verification" -}}
+    {{- end -}}
+    {{- if and $globalTls.enabled (eq $ag.engine "cert-manager") -}}
+        {{- if not (.Capabilities.APIVersions.Has "cert-manager.io/v1") -}}
+            {{- fail "tls.autoGenerated.engine=cert-manager requires cert-manager CRDs. Install cert-manager first." -}}
+        {{- end -}}
+        {{- if and $ag.certManager.existingIssuer (not (or (eq $ag.certManager.existingIssuerKind "Issuer") (eq $ag.certManager.existingIssuerKind "ClusterIssuer"))) -}}
+            {{- fail (printf "tls.autoGenerated.certManager.existingIssuerKind must be Issuer or ClusterIssuer (got: %q)" $ag.certManager.existingIssuerKind) -}}
+        {{- end -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Returns the REST API endpoint URL for in-cluster clients.
+TLS disabled: plain HTTP on port 8081. TLS enabled: HTTPS on port 8080.
+*/}}
+{{- define "rest_api_endpoint" -}}
+{{- if .Values.security.tls.enabled -}}
+    {{- printf "https://%s-api-rest:8080" .Release.Name -}}
+{{- else -}}
+    {{- printf "http://%s-api-rest:8081" .Release.Name -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Returns the Secret name for the api-rest server TLS certificate and key.
+Used when tls.enabled=true and engine != pod.
+*/}}
+{{- define "rest_api_tls_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- if $globalTls.enabled }}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $restTls.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $restTls.certManager.secretName | default (printf "%s-api-rest-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rest_api_tls_csi_controller_client_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $client := .Values.apis.rest.security.tls.clients.csiController -}}
+{{- if $globalTls.enabled -}}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $client.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $client.certManager.secretName | default (printf "%s-api-rest-csi-controller-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-csi-controller-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rest_api_tls_csi_node_client_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $client := .Values.apis.rest.security.tls.clients.csiNode -}}
+{{- if $globalTls.enabled -}}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $client.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $client.certManager.secretName | default (printf "%s-api-rest-csi-node-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-csi-node-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rest_api_tls_callhome_client_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $client := .Values.apis.rest.security.tls.clients.callhome -}}
+{{- if $globalTls.enabled -}}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $client.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $client.certManager.secretName | default (printf "%s-api-rest-callhome-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-callhome-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rest_api_tls_metrics_exporter_client_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $client := .Values.apis.rest.security.tls.clients.metricsExporter -}}
+{{- if $globalTls.enabled -}}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $client.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $client.certManager.secretName | default (printf "%s-api-rest-metrics-exporter-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-metrics-exporter-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rest_api_tls_diskpool_operator_client_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $client := .Values.apis.rest.security.tls.clients.diskpoolOperator -}}
+{{- if $globalTls.enabled -}}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $client.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $client.certManager.secretName | default (printf "%s-api-rest-diskpool-operator-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-diskpool-operator-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rest_api_tls_plugin_client_secret_name" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $client := .Values.apis.rest.security.tls.clients.plugin -}}
+{{- if $globalTls.enabled -}}
+    {{- if not $globalTls.autoGenerated.enabled -}}
+        {{- $client.existingSecret -}}
+    {{- else if eq $globalTls.autoGenerated.engine "cert-manager" -}}
+        {{- $client.certManager.secretName | default (printf "%s-api-rest-plugin-crt" .Release.Name) -}}
+    {{- else -}}
+        {{- printf "%s-api-rest-plugin-crt" .Release.Name -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Returns the pod annotation value for kubectl-plugin TLS auto-discovery.
+Format: "{mode}:{secretName}". Empty when TLS is disabled or engine is pod.
+  mtls mode:         references the plugin client cert (used for port-forward with localhost SAN).
+  server-verify mode: references the server cert (plugin only needs ca.crt; no client cert exists).
+Usage: {{ include "rest_api_tls_annotation" . }}
+*/}}
+{{- define "rest_api_tls_annotation" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $globalTls.mutualAuth $restTls -}}
+{{- if and $globalTls.enabled (or (not $globalTls.autoGenerated.enabled) (ne $globalTls.autoGenerated.engine "pod")) -}}
+    {{- if $mutualAuth -}}
+        {{- printf "mtls:%s" (include "rest_api_tls_plugin_client_secret_name" .) -}}
+    {{- else -}}
+        {{- printf "server-verify:%s" (include "rest_api_tls_secret_name" .) -}}
+    {{- end -}}
+{{- else if and $globalTls.enabled $globalTls.autoGenerated.enabled (eq $globalTls.autoGenerated.engine "pod") }}
+    {{- print "auto" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Returns TLS CLI args for in-cluster REST API clients (metrics-exporter, callhome, CSI, pool operator).
+  disabled or engine=pod: empty
+  server-only (not mutualAuth):  --tls-ca-file
+  mutualAuth:                    --tls-ca-file + --tls-cert-file + --tls-key-file
+Usage: {{- include "rest_api_tls_client_args" . | nindent N }}
+*/}}
+{{- define "rest_api_tls_client_args" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $globalTls.mutualAuth $restTls -}}
+{{- if and $globalTls.enabled (or (not $globalTls.autoGenerated.enabled) (ne $globalTls.autoGenerated.engine "pod")) -}}
+    {{- if $mutualAuth }}
+- "--tls-ca-file=/etc/tls/ca.crt"
+- "--tls-cert-file=/etc/tls/tls.crt"
+- "--tls-key-file=/etc/tls/tls.key"
+    {{- else }}
+- "--tls-ca-file=/etc/tls/ca.crt"
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Returns the volumeMount block for in-cluster REST API clients.
+Usage: {{- include "rest_api_tls_client_volume_mount" . | nindent N }}
+*/}}
+{{- define "rest_api_tls_client_volume_mount" -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- if and $globalTls.enabled (or (not $globalTls.autoGenerated.enabled) (ne $globalTls.autoGenerated.engine "pod")) -}}
+- name: api-rest-tls
+  mountPath: /etc/tls
+  readOnly: true
+{{- end -}}
+{{- end -}}
+
+{{/*
+Returns the volume declaration for in-cluster REST API clients.
+Accepts either the plain chart context (.) for backwards compat, or a dict of the form:
+  (dict "ctx" . "secretName" "the-per-client-secret-name")
+When secretName is provided and mutualAuth is true, it is used directly.
+Otherwise the server TLS secret (ca.crt only) is used.
+Usage: {{- include "rest_api_tls_client_volume" . | nindent N }}
+       {{- include "rest_api_tls_client_volume" (dict "ctx" . "secretName" (include "rest_api_tls_csi_controller_client_secret_name" .)) | nindent N }}
+*/}}
+{{- define "rest_api_tls_client_volume" -}}
+{{- $ctx := . -}}
+{{- $secretName := "" -}}
+{{- if hasKey . "ctx" -}}
+    {{- $ctx = .ctx -}}
+    {{- $secretName = .secretName -}}
+{{- end -}}
+{{- $globalTls := $ctx.Values.security.tls -}}
+{{- $restTls := $ctx.Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $globalTls.mutualAuth $restTls -}}
+{{- if and $globalTls.enabled (or (not $globalTls.autoGenerated.enabled) (ne $globalTls.autoGenerated.engine "pod")) -}}
+- name: api-rest-tls
+  secret:
+    secretName: {{ if and $mutualAuth $secretName -}}
+      {{- $secretName }}
+    {{- else -}}
+      {{- include "rest_api_tls_secret_name" $ctx }}
+    {{- end }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Resolves and emits a single helm-engine TLS Secret.
+Reuses the existing secret if it was signed by the current CA; otherwise generates a fresh leaf cert.
+Args (dict):
+  ctx          — root context (.)
+  ca           — CA struct from genCA / buildCustomCert
+  caExists     — bool: whether the CA secret was found in the cluster
+  certDuration — leaf cert validity in days
+  secretName   — Kubernetes Secret name to look up and emit
+  cn           — X.509 common name for the generated cert
+  dnsSANs      — list of DNS SANs (empty list for client certs, ["localhost"] for plugin)
+  app          — value for the "app" label
+*/}}
+{{- define "tls_helm_leaf_secret" -}}
+{{- $ctx := .ctx -}}
+{{- $ca := .ca -}}
+{{- $existing := lookup "v1" "Secret" $ctx.Release.Namespace .secretName -}}
+{{- $existingCaCrt := "" -}}
+{{- if and $existing $existing.data (index $existing.data "ca.crt") -}}
+  {{- $existingCaCrt = index $existing.data "ca.crt" -}}
+{{- end -}}
+{{- $cert := "" -}}
+{{- $key := "" -}}
+{{- if and .caExists $existing $existing.data (index $existing.data "tls.crt") (eq $existingCaCrt ($ca.Cert | b64enc)) -}}
+  {{- $cert = index $existing.data "tls.crt" | b64dec -}}
+  {{- $key = index $existing.data "tls.key" | b64dec -}}
+{{- else -}}
+  {{- $g := genSignedCert .cn (list) .dnsSANs .certDuration $ca -}}
+  {{- $cert = $g.Cert -}}
+  {{- $key = $g.Key -}}
+{{- end -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .secretName }}
+  namespace: {{ $ctx.Release.Namespace }}
+  labels:
+    app: {{ .app }}
+    {{ include "label_prefix" $ctx }}/release: {{ $ctx.Release.Name }}
+    {{ include "label_prefix" $ctx }}/version: {{ $ctx.Chart.Version }}
+type: kubernetes.io/tls
+data:
+  ca.crt: {{ $ca.Cert | b64enc }}
+  tls.crt: {{ $cert | b64enc }}
+  tls.key: {{ $key | b64enc }}
+{{- end -}}
@@ -0,0 +1,16 @@
+{{ if and (eq (include "etcdEnabled" .) "true") (and .Values.etcd.localpvScConfig.enabled .Values.etcd.persistence.enabled) }}
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    cas.openebs.io/config: |
+      - name: StorageType
+        value: "hostpath"
+      - name: BasePath
+        value: {{ tpl (.Values.etcd.localpvScConfig.basePath | quote) . }}
+    openebs.io/cas-type: local
+  name: {{ (tpl (.Values.etcd.localpvScConfig.name) .) | required (print "StorageClass name for etcd localpv storage cannot be empty") }}
+provisioner: openebs.io/local
+reclaimPolicy: {{ .Values.etcd.localpvScConfig.reclaimPolicy }}
+volumeBindingMode: {{ .Values.etcd.localpvScConfig.volumeBindingMode }}
+{{ end }}
@@ -0,0 +1,22 @@
+---
+{{ if and (eq (include "etcdEnabled" .) "true") (and .Values.etcd.persistence.enabled (eq .Values.etcd.persistence.storageClass "manual")) }}
+{{- range $index, $end := until (.Values.etcd.replicaCount | int) }}
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: etcd-volume-{{ $index }}
+  labels:
+    statefulset.kubernetes.io/pod-name: {{ print $.Release.Name }}-etcd-{{ $index }}
+spec:
+  storageClassName: manual
+  # You must also delete the hostpath on the node
+  persistentVolumeReclaimPolicy: {{ $.Values.etcd.persistentVolumeClaimRetentionPolicy.whenDeleted }}
+  capacity:
+    storage: {{ $.Values.etcd.persistence.size | quote }}
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: "/var/local/{{ $.Release.Name }}/etcd/pod-{{ $index }}"
+---
+{{- end }}
+{{- end }}
@@ -0,0 +1,23 @@
+{{- if .Values.base.jaeger.enabled }}
+apiVersion: jaegertracing.io/v1
+kind: Jaeger
+metadata:
+  name: jaeger
+  namespace: {{ .Release.Namespace }}
+labels:
+  {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  strategy: allInOne
+  ingress:
+    enabled: false
+  {{- include "jaeger_scheduling" . }}
+  query:
+    serviceType: NodePort
+    nodePort: 30012
+  storage:
+    type: memory
+    options:
+      memory:
+        max-traces: 100000
+{{- end }}
@@ -0,0 +1,33 @@
+{{- if and (.Values.loki.localpvScConfig.enabled) (.Values.loki.singleBinary.persistence.enabled) (.Values.loki.enabled) }}
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    cas.openebs.io/config: |
+      - name: StorageType
+        value: "hostpath"
+      - name: BasePath
+        value: {{ tpl ( .Values.loki.localpvScConfig.loki.basePath | quote ) . }}
+    openebs.io/cas-type: local
+  name: {{ tpl .Values.loki.localpvScConfig.loki.name . | required "StorageClass name for loki localpv storage cannot be empty" }}
+provisioner: openebs.io/local
+reclaimPolicy: {{ .Values.loki.localpvScConfig.loki.reclaimPolicy }}
+volumeBindingMode: {{ .Values.loki.localpvScConfig.loki.volumeBindingMode }}
+{{- end }}
+---
+{{- if and (.Values.loki.localpvScConfig.enabled) (.Values.loki.minio.persistence.enabled) (.Values.loki.enabled) }}
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    cas.openebs.io/config: |
+      - name: StorageType
+        value: "hostpath"
+      - name: BasePath
+        value: {{ tpl ( .Values.loki.localpvScConfig.minio.basePath | quote ) . }}
+    openebs.io/cas-type: local
+  name: {{ tpl .Values.loki.localpvScConfig.minio.name . | required "StorageClass name for loki localpv storage cannot be empty" }}
+provisioner: openebs.io/local
+reclaimPolicy: {{ .Values.loki.localpvScConfig.minio.reclaimPolicy }}
+volumeBindingMode: {{ .Values.loki.localpvScConfig.minio.volumeBindingMode }}
+{{- end }}
@@ -0,0 +1,134 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-agent-core
+  labels:
+    app: agent-core
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: agent-core
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: agent-core
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-service-account
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      initContainers:
+        {{- include "base_init_core_containers" . }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.agents.core.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.agents.core.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $tolerations := include "_tolerations_with_early_eviction" (dict "template" . "localTolerations" .Values.agents.core.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      containers:
+        - name: agent-core
+          resources:
+            limits:
+              cpu: {{ .Values.agents.core.resources.limits.cpu | quote }}
+              memory: {{ .Values.agents.core.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.agents.core.resources.requests.cpu | quote }}
+              memory: {{ .Values.agents.core.resources.requests.memory | quote }}
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-agent-core:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          args:
+            - "--store={{ include "etcdUrl" . }}"
+            - "--request-timeout={{ default .Values.base.default_req_timeout .Values.agents.core.requestTimeout }}"
+            {{- if not .Values.agents.core.minTimeouts }}
+            - "--no-min-timeouts"
+            {{- end }}
+            - "--cache-period={{ .Values.base.cache_poll_period }}"{{ if .Values.base.jaeger.enabled }}
+            - "--jaeger={{ include "jaeger_url" . }}"{{ end }}
+            - "--grpc-server-addr=[::]:50051"
+            - "--pool-commitment={{ .Values.agents.core.capacity.thin.poolCommitment }}"
+            - "--snapshot-commitment={{ .Values.agents.core.capacity.thin.snapshotCommitment }}"
+            - "--volume-commitment-initial={{ .Values.agents.core.capacity.thin.volumeCommitmentInitial }}"
+            - "--volume-commitment={{ .Values.agents.core.capacity.thin.volumeCommitment }}"{{ if .Values.eventing.enabled }}
+            - "--events-url=nats://{{ .Release.Name }}-nats:4222"
+            - "--events-replicas={{ include "events_replicas" . }}"{{ end }}{{ if not .Values.agents.ha.enabled }}
+            - "--disable-ha"{{ end }}
+            - "--fmt-style={{ include "logFormat" . }}"
+            - "--ansi-colors={{ .Values.base.logging.color }}"
+            - "--create-volume-limit={{ .Values.agents.core.maxCreateVolume }}"
+            {{- if $wait := default ((.Values.agents.core.rebuild).partial).waitPeriod .Values.agents.core.partialRebuildWaitPeriod }}
+            - "--faulted-child-wait-period={{ $wait }}"{{ end }}
+            {{- if (.Values.agents.core.rebuild).maxConcurrent }}
+            - "--max-rebuilds={{ .Values.agents.core.rebuild.maxConcurrent }}"{{ end }}
+            {{- if eq ((.Values.agents.core.rebuild).partial).enabled false }}
+            - "--disable-partial-rebuild"{{ end }}
+            {{- if not (default false .Values.agents.core.volumeHealth) }}
+            - "--no-volume-health"{{ end }}
+            {{- if eq .Values.agents.core.encryptedPoolsSoftScheduling true }}
+            - "--encrypted-pools-soft-scheduling"{{- end }}
+            {{- if eq .Values.agents.core.allowNonPersistentDevlink true}}
+            - "--allow-non-persistent-devlink"{{- end }}
+            {{- with .Values.agents.core.poolClusterSize }}
+            - "--pool-cluster-size={{ . }}"{{- end }}
+
+          ports:
+            - containerPort: 50051
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.agents.core.logLevel }}
+            {{- if default .Values.base.logging.silenceLevel .Values.agents.core.logSilenceLevel }}
+            - name: RUST_LOG_SILENCE
+              value: {{ default .Values.base.logging.silenceLevel .Values.agents.core.logSilenceLevel }}
+            {{- end }}
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+        - name: agent-ha-cluster
+          resources:
+            limits:
+              cpu: {{ .Values.agents.ha.cluster.resources.limits.cpu | quote }}
+              memory: {{ .Values.agents.ha.cluster.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.agents.ha.cluster.resources.requests.cpu | quote }}
+              memory: {{ .Values.agents.ha.cluster.resources.requests.memory | quote }}
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-agent-ha-cluster:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          args:
+            - "-g=[::]:50052"
+            - "--store=http://{{ include "etcdUrl" . }}"
+            - "--core-grpc=https://{{ .Release.Name }}-agent-core:50051"{{ if .Values.base.jaeger.enabled }}
+            - "--jaeger={{ include "jaeger_url" . }}"{{ end }}{{ if .Values.eventing.enabled }}
+            - "--events-url=nats://{{ .Release.Name }}-nats:4222"
+            - "--events-replicas={{ include "events_replicas" . }}"{{ end }}
+            - "--ansi-colors={{ .Values.base.logging.color }}"
+            - "--fmt-style={{ include "logFormat" . }}"
+          ports:
+            - containerPort: 50052
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.agents.core.logLevel }}
+            {{- if default .Values.base.logging.silenceLevel .Values.agents.core.logSilenceLevel }}
+            - name: RUST_LOG_SILENCE
+              value: {{ default .Values.logging.silenceLevel .Values.agents.core.logSilenceLevel }}
+            {{- end }}
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-agent-core
+  labels:
+    app: agent-core
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  selector:
+    app: agent-core
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  ports:
+    - name: grpc
+      port: 50051
+    - name: ha-cluster
+      port: 50052
@@ -0,0 +1,118 @@
+{{- if .Values.agents.ha.enabled }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ .Release.Name }}-agent-ha-node
+  labels:
+    app: agent-ha-node
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  selector:
+    matchLabels:
+      app: agent-ha-node
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+  minReadySeconds: 10
+  template:
+    metadata:
+      labels:
+        app: agent-ha-node
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      initContainers:
+        {{- include "base_init_ha_node_containers" . }}
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.agents.ha.node.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      nodeSelector:
+        {{- include "node_selector" (dict "template" . "localNodeSelector" .Values.agents.ha.node.nodeSelector) }}
+        {{- if .Values.csi.node.topology.nodeSelector }}
+        {{- range $key, $val := .Values.csi.node.topology.segments }}
+        {{ $key }}: {{ $val }}
+        {{- end }}
+        {{- end }}
+      {{- if $tolerations := include "tolerations" (dict "template" . "localTolerations" .Values.agents.ha.node.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      containers:
+      - name: agent-ha-node
+        image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-agent-ha-node:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+        imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+        securityContext:
+          privileged: true
+        env:
+        - name: RUST_LOG
+          value: {{ .Values.agents.ha.node.logLevel }}
+        {{- if default .Values.base.logging.silenceLevel .Values.agents.ha.node.logSilenceLevel }}
+        - name: RUST_LOG_SILENCE
+          value: {{ default .Values.base.logging.silenceLevel .Values.agents.ha.node.logSilenceLevel }}
+        {{- end }}
+        - name: MY_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: RUST_BACKTRACE
+          value: "1"
+        args:
+        - "--node-name=$(MY_NODE_NAME)"
+        - "--csi-socket={{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}/{{ .Values.csi.node.socketPath }}"
+        - "--grpc-ip=$(MY_POD_IP)"
+        - "--grpc-port={{ default 50053 .Values.agents.ha.node.port }}"
+        - "--cluster-agent=https://{{ .Release.Name }}-agent-core:50052"{{ if .Values.base.jaeger.enabled }}
+        - "--jaeger={{ include "jaeger_url" . }}"{{ end }}{{ if .Values.eventing.enabled }}
+        - "--events-url=nats://{{ .Release.Name }}-nats:4222"
+        - "--events-replicas={{ include "events_replicas" . }}"{{ end }}
+        - "--ansi-colors={{ .Values.base.logging.color }}"
+        - "--fmt-style={{ include "logFormat" . }}"
+        volumeMounts:
+        - name: device
+          mountPath: /dev
+        - name: sys
+          mountPath: /sys
+        - name: run-udev
+          mountPath: /run/udev
+        - name: plugin-dir
+          mountPath: {{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}
+        resources:
+          limits:
+            cpu: {{ .Values.agents.ha.node.resources.limits.cpu | quote }}
+            memory: {{ .Values.agents.ha.node.resources.limits.memory | quote }}
+          requests:
+            cpu: {{ .Values.agents.ha.node.resources.requests.cpu | quote }}
+            memory: {{ .Values.agents.ha.node.resources.requests.memory | quote }}
+        ports:
+          - containerPort: {{ default 50053 .Values.agents.ha.node.port }}
+            protocol: TCP
+            name: ha-node
+      volumes:
+      - name: device
+        hostPath:
+          path: /dev
+          type: Directory
+      - name: sys
+        hostPath:
+          path: /sys
+          type: Directory
+      - name: run-udev
+        hostPath:
+          path: /run/udev
+          type: Directory
+      - name: plugin-dir
+        hostPath:
+          path: {{ .Values.csi.node.kubeletDir }}/plugins/io.openebs.mayastor/
+          type: DirectoryOrCreate
+{{- end }}
@@ -0,0 +1,39 @@
+{{- $globalTls := .Values.security.tls -}}
+{{- $duration := $globalTls.autoGenerated.certManager.duration -}}
+{{- $renewBefore := $globalTls.autoGenerated.certManager.renewBefore -}}
+{{- if and $globalTls.enabled $globalTls.autoGenerated.enabled (eq $globalTls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ .Release.Name }}-api-rest-crt
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: api-rest
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_secret_name" . }}
+  commonName: {{ printf "%s-api-rest.%s.svc.%s" .Release.Name .Release.Namespace ( default "cluster.local" .Values.global.clusterDomain) }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  dnsNames:
+    - localhost
+    - {{ .Release.Name }}-api-rest
+    - {{ .Release.Name }}-api-rest.{{ .Release.Namespace }}.svc
+    - {{ .Release.Name }}-api-rest.{{ .Release.Namespace }}.svc.cluster.local
+    {{- if .Values.global.clusterDomain }}
+    - {{ .Release.Name }}-api-rest.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}
+    {{- end }}
+  usages:
+    - server auth
+  privateKey:
+    algorithm: {{ $globalTls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $globalTls.autoGenerated.certManager.keySize }}
+  duration: {{ $duration }}
+  renewBefore: {{ $renewBefore }}
+{{- end -}}
@@ -0,0 +1,121 @@
+{{- $globalTls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $globalTls.mutualAuth $restTls -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-api-rest
+  labels:
+    app: api-rest
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  replicas: {{ .Values.apis.rest.replicaCount }}
+  selector:
+    matchLabels:
+      app: api-rest
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: api-rest
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+      {{- if $globalTls.enabled }}
+      annotations:
+        openebs.io/rest-tls: {{ include "rest_api_tls_annotation" . }}
+      {{- end }}
+    spec:
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      initContainers:
+        {{- include "base_init_containers" . }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.apis.rest.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.apis.rest.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $tolerations := include "_tolerations_with_early_eviction" (dict "template" . "localTolerations" .Values.apis.rest.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      containers:
+        - name: api-rest
+          resources:
+            limits:
+              cpu: {{ .Values.apis.rest.resources.limits.cpu | quote }}
+              memory: {{ .Values.apis.rest.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.apis.rest.resources.requests.cpu | quote }}
+              memory: {{ .Values.apis.rest.resources.requests.memory | quote }}
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-api-rest:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy}}
+          args:
+            {{- if not $globalTls.enabled }}
+            - "--dummy-certificates"
+            - "--http=[::]:8081"
+            {{- else if and $globalTls.autoGenerated.enabled (eq $globalTls.autoGenerated.engine "pod") }}
+            - "--auto-tls"
+            - "--http-probes=[::]:8081"
+            {{- else }}
+            - "--http-probes=[::]:8081"
+            - "--tls-cert-file=/etc/tls/server/tls.crt"
+            - "--tls-key-file=/etc/tls/server/tls.key"
+            {{- if $mutualAuth }}
+            - "--tls-ca-file=/etc/tls/server/ca.crt"
+            {{- end }}
+            {{- end }}
+            - "--no-auth"
+            - "--request-timeout={{ .Values.base.default_req_timeout }}"{{ if .Values.base.jaeger.enabled }}
+            - "--jaeger={{ include "jaeger_url" . }}"{{ end }}
+            - "--core-grpc=https://{{ .Release.Name }}-agent-core:50051"
+            - "--ansi-colors={{ .Values.base.logging.color }}"
+            - "--fmt-style={{ include "logFormat" . }}"
+            {{- if .Values.apis.rest.healthProbes.readiness.enabled }}
+            - "--core-health-freq={{ .Values.apis.rest.healthProbes.readiness.agentCoreProbeFreq }}"
+            {{- end }}
+          ports:
+            - containerPort: 8080
+            {{- if not .Values.security.tls.enabled }}
+            - containerPort: 8081
+            {{- end }}
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.apis.rest.logLevel }}
+            {{- if default .Values.base.logging.silenceLevel .Values.apis.rest.logSilenceLevel }}
+            - name: RUST_LOG_SILENCE
+              value: {{ default .Values.base.logging.silenceLevel .Values.apis.rest.logSilenceLevel }}
+            {{- end }}
+          {{- if .Values.apis.rest.healthProbes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8081
+            failureThreshold: {{ .Values.apis.rest.healthProbes.readiness.failureThreshold }}
+            initialDelaySeconds: {{ .Values.apis.rest.healthProbes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.apis.rest.healthProbes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.apis.rest.healthProbes.readiness.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.apis.rest.healthProbes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: 8081
+            failureThreshold: {{ .Values.apis.rest.healthProbes.liveness.failureThreshold }}
+            initialDelaySeconds: {{ .Values.apis.rest.healthProbes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.apis.rest.healthProbes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.apis.rest.healthProbes.liveness.timeoutSeconds }}
+          {{- end }}
+          {{- if and $globalTls.enabled (or (not $globalTls.autoGenerated.enabled) (ne $globalTls.autoGenerated.engine "pod")) }}
+          volumeMounts:
+            - name: api-rest-ca-crt
+              mountPath: /etc/tls/server
+              readOnly: true
+          {{- end }}
+      {{- if and $globalTls.enabled (or (not $globalTls.autoGenerated.enabled) (ne $globalTls.autoGenerated.engine "pod")) }}
+      volumes:
+        - name: api-rest-ca-crt
+          secret:
+            secretName: {{ include "rest_api_tls_secret_name" . }}
+      {{- end }}
@@ -0,0 +1,28 @@
+{{- if .Values.security.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-api-rest
+  labels:
+    app: api-rest
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  podSelector:
+    matchLabels:
+      app: api-rest
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow inbound traffic
+    - ports:
+        # Allow HTTPS traffic
+        - port: 8080
+          protocol: TCP
+    {{- if not .Values.security.tls.enabled }}
+        # Allow HTTP traffic
+        - port: 8081
+          protocol: TCP
+    {{- end }}
+{{- end }}
@@ -0,0 +1,33 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled $mutualAuth (eq $tls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "rest_api_tls_plugin_client_secret_name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: plugin
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_plugin_client_secret_name" . }}
+  commonName: {{ printf "%s-api-rest-plugin" .Release.Name }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  dnsNames:
+    - localhost
+  usages:
+    - client auth
+  privateKey:
+    algorithm: {{ $tls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $tls.autoGenerated.certManager.keySize }}
+  duration: {{ $tls.autoGenerated.certManager.duration }}
+  renewBefore: {{ $tls.autoGenerated.certManager.renewBefore }}
+{{- end -}}
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-api-rest
+  labels:
+    app: api-rest
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  type: {{ .Values.apis.rest.service.type }}
+  selector:
+    app: api-rest
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  ports:
+    - port: 8080
+      name: https
+      targetPort: 8080
+      protocol: TCP
+      {{- if eq .Values.apis.rest.service.type "NodePort" }}
+      nodePort: {{ .Values.apis.rest.service.nodePorts.https }}
+      {{- end }}
+    {{- if not .Values.security.tls.enabled }}
+    - port: 8081
+      name: http
+      targetPort: 8081
+      protocol: TCP
+      {{- if eq .Values.apis.rest.service.type "NodePort" }}
+      nodePort: {{ .Values.apis.rest.service.nodePorts.http }}
+      {{- end }}
+    {{- end }}
@@ -0,0 +1,31 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled $mutualAuth (eq $tls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "rest_api_tls_csi_controller_client_secret_name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: csi-controller
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_csi_controller_client_secret_name" . }}
+  commonName: {{ printf "%s-api-rest-csi-controller" .Release.Name }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  usages:
+    - client auth
+  privateKey:
+    algorithm: {{ $tls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $tls.autoGenerated.certManager.keySize }}
+  duration: {{ $tls.autoGenerated.certManager.duration }}
+  renewBefore: {{ $tls.autoGenerated.certManager.renewBefore }}
+{{- end -}}
@@ -0,0 +1,147 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-csi-controller
+  labels:
+    app: csi-controller
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: csi-controller
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: csi-controller
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      hostNetwork: true
+      serviceAccountName: {{ .Release.Name }}-service-account
+      dnsPolicy: ClusterFirstWithHostNet
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      initContainers:
+        {{- include "jaeger_collector_init_container" . }}
+        {{- include "rest_agent_init_container" . }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.csi.controller.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.csi.controller.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $tolerations := include "_tolerations_with_early_eviction" (dict "template" . "localTolerations" .Values.csi.controller.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      containers:
+        - name: csi-controller
+          resources:
+            limits:
+              cpu: {{ .Values.csi.controller.resources.limits.cpu | quote }}
+              memory: {{ .Values.csi.controller.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.csi.controller.resources.requests.cpu | quote }}
+              memory: {{ .Values.csi.controller.resources.requests.memory | quote }}
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-csi-controller:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          args:
+            - "--csi-socket=/var/lib/csi/sockets/pluginproxy/csi.sock"
+            - "--rest-endpoint={{ include "rest_api_endpoint" . }}"{{ if .Values.base.jaeger.enabled }}
+            - "--jaeger={{ include "jaeger_url" . }}"{{ end }}
+            {{- range $key, $val := .Values.csi.node.topology.segments }}
+            - "--node-selector={{ $key }}={{ $val }}"
+            {{- end }}
+            - "--ansi-colors={{ .Values.base.logging.color }}"
+            - "--fmt-style={{ include "logFormat" . }}"
+            - "--create-volume-limit={{ .Values.csi.controller.maxCreateVolume }}"
+            - "--enable-orphan-vol-gc={{- .Values.csi.controller.enableDangerousRetainGC | default false }}"
+            {{- include "rest_api_tls_client_args" . | nindent 12 }}
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.csi.controller.logLevel }}
+            {{- if default .Values.base.logging.silenceLevel .Values.csi.controller.logSilenceLevel }}
+            - name: RUST_LOG_SILENCE
+              value: {{ default .Values.base.logging.silenceLevel .Values.csi.controller.logSilenceLevel }}
+            {{- end }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+            {{- include "rest_api_tls_client_volume_mount" . | nindent 12 }}
+        - name: csi-provisioner
+          image: "{{ default .Values.csi.image.registry .Values.global.imageRegistry }}/{{ .Values.csi.image.repo }}/csi-provisioner:{{ .Values.csi.image.provisionerTag }}"
+          args:
+            - "--v=2"
+            - "--csi-address=$(ADDRESS)"
+            - "--feature-gates=Topology=true"
+            - "--strict-topology=false"
+            - "--default-fstype=ext4"
+            - "--extra-create-metadata" # This is needed for volume group feature to work
+            - "--timeout=36s"
+            - "--worker-threads={{ .Values.csi.controller.maxCreateVolume }}" # 10 for create and 10 for delete
+            {{- if default .Values.csi.controller.preventVolumeModeConversion }}
+            - "--prevent-volume-mode-conversion"
+            {{- end }}
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: {{ default .Values.csi.image.pullPolicy .Values.global.imagePullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        - name: csi-attacher
+          image: "{{ default .Values.csi.image.registry .Values.global.imageRegistry }}/{{ .Values.csi.image.repo }}/csi-attacher:{{ .Values.csi.image.attacherTag }}"
+          args:
+            - "--v=2"
+            - "--timeout=36s"
+            - "--csi-address=$(ADDRESS)"
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: {{ default .Values.csi.image.pullPolicy .Values.global.imagePullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        - name: csi-snapshotter
+          image: "{{ default .Values.csi.image.registry .Values.global.imageRegistry }}/{{ .Values.csi.image.repo }}/csi-snapshotter:{{ .Values.csi.image.snapshotterTag }}"
+          args:
+            - "--v=2"
+            - "--csi-address=$(ADDRESS)"
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: {{ default .Values.csi.image.pullPolicy .Values.global.imagePullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        {{- if .Values.csi.controller.snapshotController.enabled }}
+        - name: csi-snapshot-controller
+          args:
+            - "--v=2"
+            - "--leader-election=false" # since we are running single container
+            {{- if default .Values.csi.controller.preventVolumeModeConversion }}
+            - "--prevent-volume-mode-conversion"
+            {{- end }}
+          image: "{{ default .Values.csi.image.registry .Values.global.imageRegistry }}/{{ .Values.csi.image.repo }}/snapshot-controller:{{ .Values.csi.image.snapshotControllerTag }}"
+          imagePullPolicy: {{ default .Values.csi.image.pullPolicy .Values.global.imagePullPolicy }}
+        {{- end }}
+        - name: csi-resizer
+          args:
+            - "--v=2"
+            - "--csi-address=$(ADDRESS)"
+            - "--handle-volume-inuse-error=false"
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          image: "{{ default .Values.csi.image.registry .Values.global.imageRegistry }}/{{ .Values.csi.image.repo }}/csi-resizer:{{ .Values.csi.image.resizerTag }}"
+          imagePullPolicy: {{ default .Values.csi.image.pullPolicy .Values.global.imagePullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+      volumes:
+        - name: socket-dir
+          emptyDir:
+        {{- include "rest_api_tls_client_volume" (dict "ctx" . "secretName" (include "rest_api_tls_csi_controller_client_secret_name" .)) | nindent 8 }}
@@ -0,0 +1,31 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled $mutualAuth (eq $tls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "rest_api_tls_csi_node_client_secret_name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: csi-node
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_csi_node_client_secret_name" . }}
+  commonName: {{ printf "%s-api-rest-csi-node" .Release.Name }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  usages:
+    - client auth
+  privateKey:
+    algorithm: {{ $tls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $tls.autoGenerated.certManager.keySize }}
+  duration: {{ $tls.autoGenerated.certManager.duration }}
+  renewBefore: {{ $tls.autoGenerated.certManager.renewBefore }}
+{{- end -}}
@@ -0,0 +1,177 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ .Release.Name }}-csi-node
+  labels:
+    app: csi-node
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+    {{- range $key, $val := .Values.csi.node.topology.segments }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      app: csi-node
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+  minReadySeconds: 10
+  template:
+    metadata:
+      labels:
+        app: csi-node
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-service-account
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.csi.node.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      nodeSelector:
+        {{- include "node_selector" (dict "template" . "localNodeSelector" .Values.csi.node.nodeSelector) }}
+        {{- if .Values.csi.node.topology.nodeSelector }}
+        {{- range $key, $val := .Values.csi.node.topology.segments }}
+        {{ $key }}: {{ $val }}
+        {{- end }}
+        {{- end }}
+      {{- if $tolerations := include "tolerations" (dict "template" . "localTolerations" .Values.csi.node.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      initContainers:
+        {{- include "csi_node_init_containers" . }}
+      # NOTE: Each container must have mem/cpu limits defined in order to
+      # belong to Guaranteed QoS class, hence can never get evicted in case of
+      # pressure unless they exceed those limits. limits and requests must be
+      # the same.
+      containers:
+      - name: csi-node
+        image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-csi-node:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+        imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+        # we need privileged because we mount filesystems and use mknod
+        securityContext:
+          privileged: true
+        env:
+        - name: RUST_LOG
+          value: {{ .Values.csi.node.logLevel }}
+        {{- if default .Values.base.logging.silenceLevel .Values.csi.node.logSilenceLevel }}
+        - name: RUST_LOG_SILENCE
+          value: {{ default .Values.base.logging.silenceLevel .Values.csi.node.logSilenceLevel }}
+        {{- end }}
+        - name: MY_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: RUST_BACKTRACE
+          value: "1"
+        {{- if (.Values.csi.node.mkfs_args).xfs }}
+        - name: MKFS_XFS_ARGS
+          value: {{ .Values.csi.node.mkfs_args.xfs | quote }}
+        {{- end }}
+        {{- if $safeMount := .Values.base.safeMount }}
+        - name: USE_SAFE_MOUNT
+          value: {{ $safeMount | quote }}
+        {{- end }}
+        args:
+        - "--csi-socket={{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}/{{ .Values.csi.node.socketPath }}"
+        - "--node-name=$(MY_NODE_NAME)"
+        - "--rest-endpoint={{ include "rest_api_endpoint" . }}"{{ if .Values.csi.node.restClient.enabled }}
+        - "--enable-rest"{{ end }}
+        - "--enable-registration"
+        - "--grpc-ip=$(MY_POD_IP)"
+        - "--grpc-port={{ default 10199 .Values.csi.node.port }}"{{ if .Values.csi.node.nvme.io_timeout }}
+        - "--nvme-io-timeout={{ .Values.csi.node.nvme.io_timeout }}"
+        - "--nvme-core-io-timeout={{ .Values.csi.node.nvme.io_timeout }}"{{ else }}
+        - "--nvme-io-timeout={{ .Values.io_engine.nvme.ioTimeout }}10s"
+        - "--nvme-core-io-timeout={{ .Values.io_engine.nvme.ioTimeout }}10s"{{ end }}{{ if .Values.csi.node.nvme.ctrl_loss_tmo }}
+        - "--nvme-ctrl-loss-tmo={{ .Values.csi.node.nvme.ctrl_loss_tmo }}"{{ end }}{{ if .Values.csi.node.nvme.keep_alive_tmo }}
+        - "--nvme-keep-alive-tmo={{ .Values.csi.node.nvme.keep_alive_tmo }}"{{ end }}
+        - "--nvme-nr-io-queues={{ include "coreCount" . }}"
+        - "--nvme-connect-fallback={{ .Values.csi.node.nvme.tcpFallback }}"
+        - "--kubelet-path={{ .Values.csi.node.kubeletDir }}"
+        {{- range $key, $val := .Values.csi.node.topology.segments }}
+        - "--node-selector={{ $key }}={{ $val }}"
+        {{- end }}
+        - "--fmt-style={{ include "logFormat" . }}"
+        - "--ansi-colors={{ .Values.base.logging.color }}"
+        {{- include "rest_api_tls_client_args" . | nindent 8 }}
+        volumeMounts:
+        - name: device
+          mountPath: /dev
+        - name: sys
+          mountPath: /sys
+        - name: run-udev
+          mountPath: /run/udev
+        - name: plugin-dir
+          mountPath: {{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}
+        - name: kubelet-dir
+          mountPath: {{ .Values.csi.node.kubeletDir }}
+          mountPropagation: "Bidirectional"
+        {{- include "rest_api_tls_client_volume_mount" . | nindent 8 }}
+        resources:
+          limits:
+            cpu: {{ .Values.csi.node.resources.limits.cpu | quote }}
+            memory: {{ .Values.csi.node.resources.limits.memory | quote }}
+          requests:
+            cpu: {{ .Values.csi.node.resources.requests.cpu | quote }}
+            memory: {{ .Values.csi.node.resources.requests.memory | quote }}
+      - name: csi-driver-registrar
+        image: "{{ default .Values.csi.image.registry .Values.global.imageRegistry }}/{{ .Values.csi.image.repo }}/csi-node-driver-registrar:{{ .Values.csi.image.registrarTag }}"
+        imagePullPolicy: {{ default .Values.csi.image.pullPolicy .Values.global.imagePullPolicy }}
+        args:
+        - "--csi-address={{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}/{{ .Values.csi.node.socketPath }}"
+        - "--kubelet-registration-path={{ .Values.csi.node.kubeletDir }}/plugins/io.openebs.mayastor/csi.sock"
+        volumeMounts:
+        - name: plugin-dir
+          mountPath: {{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}
+        - name: registration-dir
+          mountPath: /registration
+        resources:
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+        # Mayastor node plugin gRPC server
+        ports:
+        - containerPort: {{ default 10199 .Values.csi.node.port }}
+          protocol: TCP
+          name: mayastor-node
+      volumes:
+      - name: device
+        hostPath:
+          path: /dev
+          type: Directory
+      - name: sys
+        hostPath:
+          path: /sys
+          type: Directory
+      - name: run-udev
+        hostPath:
+          path: /run/udev
+          type: Directory
+      - name: registration-dir
+        hostPath:
+          path: {{ .Values.csi.node.kubeletDir }}/plugins_registry/
+          type: Directory
+      - name: plugin-dir
+        hostPath:
+          path: {{ .Values.csi.node.kubeletDir }}/plugins/io.openebs.mayastor/
+          type: DirectoryOrCreate
+      - name: kubelet-dir
+        hostPath:
+          path: {{ .Values.csi.node.kubeletDir }}
+          type: Directory
+      {{- include "rest_api_tls_client_volume" (dict "ctx" . "secretName" (include "rest_api_tls_csi_node_client_secret_name" .)) | nindent 6 }}
@@ -0,0 +1,31 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled $mutualAuth (eq $tls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "rest_api_tls_metrics_exporter_client_secret_name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: io-engine
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_metrics_exporter_client_secret_name" . }}
+  commonName: {{ printf "%s-api-rest-metrics-exporter" .Release.Name }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  usages:
+    - client auth
+  privateKey:
+    algorithm: {{ $tls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $tls.autoGenerated.certManager.keySize }}
+  duration: {{ $tls.autoGenerated.certManager.duration }}
+  renewBefore: {{ $tls.autoGenerated.certManager.renewBefore }}
+{{- end -}}
@@ -0,0 +1,232 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ .Release.Name }}-io-engine
+  labels:
+    app: io-engine
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  selector:
+    matchLabels:
+      app: io-engine
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  updateStrategy:
+    type: OnDelete
+  minReadySeconds: 10
+  template:
+    metadata:
+      labels:
+        app: io-engine
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-service-account
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      hostNetwork: true
+      # To resolve services in the namespace
+      dnsPolicy: ClusterFirstWithHostNet
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.io_engine.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.io_engine.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if .Values.runtimeClassName }}
+      runtimeClassName: {{ .Values.runtimeClassName | quote }}
+      {{- end }}
+      {{- if $tolerations := include "tolerations" (dict "template" . "localTolerations" .Values.io_engine.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      initContainers:
+        {{- include "base_init_containers" . }}
+      containers:
+      - name: io-engine
+        image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-io-engine:{{ default .Values.image.tag .Values.image.repoTags.dataPlane }}"
+        imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+        env:
+        - name: RUST_LOG
+          value: {{ .Values.io_engine.logLevel }}
+        - name: NVMF_TCP_NUM_SHARED_BUF
+          value: "{{ .Values.io_engine.nvme.tcp.numSharedBuf }}"
+        - name: NVMF_TCP_BUF_CACHE_SIZE
+          value: "{{ .Values.io_engine.nvme.tcp.bufCacheSize }}"
+        - name: NVMF_TCP_MAX_QPAIRS_PER_CTRL
+          value: "{{ .Values.io_engine.nvme.tcp.maxQpairsPerCtrl }}"
+        - name: NVMF_TCP_MAX_QUEUE_DEPTH
+          value: "{{ .Values.io_engine.nvme.tcp.maxQueueDepth }}"
+        - name: NVMF_TCP_IN_CAPSULE_DATA_SIZE
+          value: "{{ .Values.io_engine.nvme.tcp.inCapsuleDataSize }}"
+        - name: NVMF_TCP_MAX_IO_SIZE
+          value: "{{ .Values.io_engine.nvme.tcp.maxIoSize }}"
+        - name: NVMF_TCP_IO_UNIT_SIZE
+          value: "{{ .Values.io_engine.nvme.tcp.ioUnitSize }}"
+        {{- if .Values.io_engine.target.nvmf.rdma.enabled }}
+        - name: NVMF_RDMA_NUM_SHARED_BUF
+          value: "{{ .Values.io_engine.nvme.rdma.numSharedBuf }}"
+        - name: NVMF_RDMA_BUF_CACHE_SIZE
+          value: "{{ .Values.io_engine.nvme.rdma.bufCacheSize }}"
+        - name: NVMF_RDMA_DATA_WR_POOL_SIZE
+          value: "{{ .Values.io_engine.nvme.rdma.dataWrPoolSize }}"
+        - name: NVMF_RDMA_MAX_IO_SIZE
+          value: "{{ .Values.io_engine.nvme.rdma.maxIoSize }}"
+        - name: NVMF_RDMA_IO_UNIT_SIZE
+          value: "{{ .Values.io_engine.nvme.rdma.ioUnitSize }}"
+        - name: NVMF_RDMA_IN_CAPSULE_DATA_SIZE
+          value: "{{ .Values.io_engine.nvme.rdma.inCapsuleDataSize }}"
+        {{- end }}
+        - name: NVME_TIMEOUT
+          value: "{{ .Values.io_engine.nvme.ioTimeout }}"
+        - name: NVME_TIMEOUT_ADMIN
+          value: "{{ .Values.io_engine.nvme.adminTimeout }}"
+        - name: NVME_KATO
+          value: "{{ .Values.io_engine.nvme.keepAliveTimeout }}"
+        - name: NVME_MAX_NAMESPACES
+          value: "{{ default 4096 .Values.io_engine.target.nvmf.maxNamespaces }}"
+        - name: MY_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: NEXUS_NVMF_ANA_ENABLE
+          value: "1"
+        - name: NEXUS_NVMF_RESV_ENABLE
+          value: "1"
+        {{- if .Values.io_engine.nvme.transportTos }}
+        - name: NVME_TRANSPORT_TOS
+          value: "{{ .Values.io_engine.nvme.transportTos }}"
+        {{- end }}
+        {{- if $safeMount := .Values.base.safeMount }}
+        - name: USE_SAFE_MOUNT
+          value: {{ $safeMount | quote }}
+        {{- end }}
+        {{- if .Values.io_engine.interruptMode.enabled }}
+        - name: ENABLE_INTERRUPT_MODE
+          value: "true"
+        - name: NVME_IOQ_POLL_PERIOD
+          value: {{ .Values.io_engine.interruptMode.nvmeIoQueuePollPeriod | quote }}
+        {{- end }}
+        {{- if .Values.io_engine.pool.diskHandleRescan.enabled }}
+        - name: POOL_HANDLE_RESCAN_PERIOD
+          value: {{ default "5m" .Values.io_engine.pool.diskHandleRescan.period | quote }}
+        {{- end }}
+        args:
+        # The -l argument accepts cpu-list. Indexing starts at zero.
+        # For example -l 1,2,10-20 means use core 1, 2, 10 to 20.
+        # Note: Ensure that the CPU resources are updated accordingly.
+        #       If you use 2 CPUs, the CPU: field should also read 2.
+        - "--grpc-ip=$(MY_POD_IP)"
+        - "--grpc-port={{ default 10124 .Values.io_engine.port }}"
+        - "-N$(MY_NODE_NAME)"
+        - "-Rhttps://{{ .Release.Name }}-agent-core:50051"
+        - "-y/var/local/{{ .Release.Name }}/io-engine/config.yaml"
+        - "-l{{ include "cpuFlag" . }}"
+        - "-p={{ include "etcdUrl" . }}"{{ if .Values.io_engine.target.nvmf.ptpl }}
+        - "--ptpl-dir=/var/local/{{ .Release.Name }}/io-engine/ptpl/"{{ end }}
+        - "--api-versions={{ .Values.io_engine.api }}"{{ if .Values.io_engine.target.nvmf.rdma.enabled }}
+        - "--enable-rdma"{{ end }}{{ if .Values.io_engine.target.nvmf.iface }}
+        - "-T={{ .Values.io_engine.target.nvmf.iface }}"{{ end }}{{ if .Values.io_engine.envcontext }}
+        - "--env-context=--{{ .Values.io_engine.envcontext }}"{{ end }}{{ if .Values.io_engine.reactorFreezeDetection.enabled }}
+        - "--reactor-freeze-detection"{{ end }}
+        - "--tgt-crdt={{ .Values.io_engine.target.nvmf.hostCmdRetryDelay.crdt1 }}"{{ if .Values.eventing.enabled }}
+        - "--events-url=nats://{{ .Release.Name }}-nats:4222"
+        - "--events-replicas={{ include "events_replicas" . }}"{{ end }}
+        - "--ps-retries={{ default 300 .Values.io_engine.pstorRetries }}"
+        - "--pool-io-error-threshold={{ default 64 .Values.io_engine.pool.ioAlerts.errorThreshold }}"
+        - "--pool-io-stall-deadline={{ default (printf "%s%s" .Values.io_engine.nvme.ioTimeout .Values.io_engine.nvme.ioTimeout) .Values.io_engine.pool.ioAlerts.stallDeadline }}"
+        - "--pool-io-stall-transition-threshold={{ default 3 .Values.io_engine.pool.ioAlerts.stallTransitionThreshold }}"
+        - "--pool-io-stall-transition-window={{ default "3h" .Values.io_engine.pool.ioAlerts.stallTransitionWindow }}"
+        command:
+        - io-engine
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: device
+          mountPath: /dev
+        - name: udev
+          mountPath: /run/udev
+        - name: dshm
+          mountPath: /dev/shm
+        - name: configlocation
+          mountPath: /var/local/{{ .Release.Name }}/io-engine/
+        - name: hugepages-2mi
+          mountPath: /dev/hugepages-2mi
+        {{- if .Values.io_engine.resources.requests.hugepages1Gi }}
+        - name: hugepages-1gi
+          mountPath: /dev/hugepages-1gi
+        {{- end }}
+        resources:
+          limits:
+            cpu: {{ .Values.io_engine.resources.limits.cpu | default (include "coreCount" .) | quote }}
+            memory: {{ .Values.io_engine.resources.limits.memory | quote }}
+            hugepages-2Mi: {{ .Values.io_engine.resources.limits.hugepages2Mi | quote }}
+            hugepages-1Gi: {{ .Values.io_engine.resources.requests.hugepages1Gi | quote }}
+          requests:
+            cpu: {{ .Values.io_engine.resources.requests.cpu | default (include "coreCount" .) | quote }}
+            memory: {{ .Values.io_engine.resources.requests.memory | quote }}
+            hugepages-2Mi: {{ .Values.io_engine.resources.requests.hugepages2Mi | quote }}
+            hugepages-1Gi: {{ .Values.io_engine.resources.requests.hugepages1Gi | quote }}
+        ports:
+        - containerPort: {{ default 10124 .Values.io_engine.port }}
+          protocol: TCP
+          name: io-engine
+      {{- if .Values.base.metrics.enabled }}
+      - name: metrics-exporter-io-engine
+        image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-metrics-exporter-io-engine:{{ default .Values.image.tag .Values.image.repoTags.extensions }}"
+        imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+        env:
+        - name: MY_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        ports:
+          - containerPort: {{ default 9502 .Values.base.metrics.port }}
+            protocol: TCP
+            name: metrics
+        args:
+          - "--metrics-endpoint=[::]:{{ default 9502 .Values.base.metrics.port }}"
+          - "--grpc-port={{ default 10124 .Values.io_engine.port }}"
+          - "--fmt-style={{ include "logFormat" . }}"
+          - "--ansi-colors={{ .Values.base.logging.color }}"
+          - "--rest-endpoint={{ include "rest_api_endpoint" . }}"
+          {{- include "rest_api_tls_client_args" . | nindent 10 }}
+        {{- if and .Values.security.tls.enabled (or (not .Values.security.tls.autoGenerated.enabled) (ne .Values.security.tls.autoGenerated.engine "pod")) }}
+        volumeMounts:
+          {{- include "rest_api_tls_client_volume_mount" . | nindent 10 }}
+        {{- end }}
+      {{- end }}
+      volumes:
+      - name: device
+        hostPath:
+          path: /dev
+          type: Directory
+      - name: udev
+        hostPath:
+          path: /run/udev
+          type: Directory
+      - name: dshm
+        emptyDir:
+          medium: Memory
+          sizeLimit: "1Gi"
+      - name: hugepages-2mi
+        emptyDir:
+          medium: HugePages-2Mi
+      {{- if .Values.io_engine.resources.requests.hugepages1Gi }}
+      - name: hugepages-1gi
+        emptyDir:
+          medium: HugePages-1Gi
+      {{- end }}
+      - name: configlocation
+        hostPath:
+          path: /var/local/{{ .Release.Name }}/io-engine/
+          type: DirectoryOrCreate
+      {{- include "rest_api_tls_client_volume" (dict "ctx" . "secretName" (include "rest_api_tls_metrics_exporter_client_secret_name" .)) | nindent 6 }}
@@ -0,0 +1,19 @@
+{{- if .Values.base.metrics.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-metrics-exporter-io-engine
+  labels:
+    app: metrics-exporter-io-engine
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  ports:
+    - name: metrics
+      port: 9502
+      targetPort: 9502
+      protocol: TCP
+  selector:
+    app: io-engine
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+{{- end }}
@@ -0,0 +1,77 @@
+{{- if and .Values.eventing.enabled .Values.eventing.aggregator.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-eventing-aggregator
+  labels:
+    app: eventing-aggregator
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: eventing-aggregator
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: eventing-aggregator
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-service-account
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      {{- if $pcName := include "priority_class" (dict "template" . "localPriorityClass" .Values.eventing.aggregator.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.eventing.aggregator.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $tolerations := include "tolerations" (dict "template" . "localTolerations" .Values.eventing.aggregator.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      {{- if (.Values.eventing.aggregator.initContainers).enabled }}
+      initContainers:
+        {{- include "render_init_containers" (dict "value" .Values.eventing.aggregator.initContainers.containers "context" $) | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: eventing-aggregator
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-eventing-aggregator:{{ default .Values.image.tag .Values.image.repoTags.extensions }}"
+          args:
+            - "--nats-url=nats://{{ .Release.Name }}-nats:4222"
+            - "--jetstream-enabled={{ .Values.nats.nats.jetstream.enabled }}"
+            - "--loki-enabled={{ .Values.loki.enabled }}"
+            - "--subject-filter=events.>"
+            - "--events-replicas={{ include "events_replicas" . }}"
+            {{- if not .Values.loki.enabled }}
+            - "--events-dir=/var/events"
+            - "--dir-size-limit={{ .Values.eventing.aggregator.dirSizeLimit }}"
+            {{- end }}
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.eventing.aggregator.logLevel }}
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          resources:
+            limits:
+              cpu: {{ .Values.eventing.aggregator.resources.limits.cpu | quote }}
+              memory: {{ .Values.eventing.aggregator.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.eventing.aggregator.resources.requests.cpu | quote }}
+              memory: {{ .Values.eventing.aggregator.resources.requests.memory | quote }}
+          {{- if not .Values.loki.enabled }}
+          volumeMounts:
+            - name: events-store
+              mountPath: /var/events
+          {{- end }}
+      {{- if not .Values.loki.enabled }}
+      volumes:
+        - name: events-store
+          emptyDir:
+            sizeLimit: {{ .Values.eventing.aggregator.dirSizeLimit }}
+      {{- end }}
+{{- end }}
@@ -0,0 +1,31 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled $mutualAuth (eq $tls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "rest_api_tls_callhome_client_secret_name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: obs-callhome
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_callhome_client_secret_name" . }}
+  commonName: {{ printf "%s-api-rest-callhome" .Release.Name }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  usages:
+    - client auth
+  privateKey:
+    algorithm: {{ $tls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $tls.autoGenerated.certManager.keySize }}
+  duration: {{ $tls.autoGenerated.certManager.duration }}
+  renewBefore: {{ $tls.autoGenerated.certManager.renewBefore }}
+{{- end -}}
@@ -0,0 +1,102 @@
+{{- $analytics := false }}
+{{- if kindIs "bool" .Values.global.analytics.enabled }}
+{{- $analytics = .Values.global.analytics.enabled }}
+{{- else }}
+{{- $analytics = .Values.obs.callhome.enabled }}
+{{- end }}
+{{- if $analytics }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-obs-callhome
+  labels:
+    app: obs-callhome
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: obs-callhome
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: obs-callhome
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-service-account
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      {{- if $pcName := include "priority_class" (dict "template" . "localPriorityClass" .Values.obs.callhome.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.obs.callhome.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $tolerations := include "tolerations" (dict "template" . "localTolerations" .Values.obs.callhome.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      containers:
+        - name: obs-callhome
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-obs-callhome:{{ default .Values.image.tag .Values.image.repoTags.extensions }}"
+          args:
+            - "-e {{ include "rest_api_endpoint" . }}"
+            - "-n {{ .Release.Namespace }}"{{ if .Values.eventing.enabled }}
+            - "--aggregator-url=http://{{ .Release.Name }}-obs-callhome-stats:9090/stats"{{ end }}
+            {{ if .Values.obs.callhome.sendReport }}
+            - "--send-report"
+            {{ end }}
+            {{- include "rest_api_tls_client_args" . | nindent 12 }}
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.obs.callhome.logLevel }}
+          {{- if .Values.obs.callhome.productName }}
+            - name: CALLHOME_PRODUCT_NAME
+              value: {{ .Values.obs.callhome.productName | quote }}
+          {{- end }}
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          {{- if and .Values.security.tls.enabled (or (not .Values.security.tls.autoGenerated.enabled) (ne .Values.security.tls.autoGenerated.engine "pod")) }}
+          volumeMounts:
+            {{- include "rest_api_tls_client_volume_mount" . | nindent 12 }}
+          {{- end }}
+          resources:
+            limits:
+              cpu: {{ .Values.obs.callhome.resources.limits.cpu | quote }}
+              memory: {{ .Values.obs.callhome.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.obs.callhome.resources.requests.cpu | quote }}
+              memory: {{ .Values.obs.callhome.resources.requests.memory | quote }}
+        {{- if .Values.eventing.enabled }}
+        - name: obs-callhome-stats
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-obs-callhome-stats:{{ default .Values.image.tag .Values.image.repoTags.extensions }}"
+          args:
+            - "--namespace={{ .Release.Namespace }}"
+            - "--release-name={{ .Release.Name }}"
+            - "--events-url=nats://{{ .Release.Name }}-nats:4222"
+            - "--events-replicas={{ include "events_replicas" . }}"
+            - "--ansi-colors={{ .Values.base.logging.color }}"
+            - "--fmt-style={{ include "logFormat" . }}"
+          ports:
+            - containerPort: 9090
+              protocol: TCP
+              name: stats
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.obs.stats.logLevel }}
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          resources:
+            limits:
+              cpu: {{ .Values.obs.stats.resources.limits.cpu | quote }}
+              memory: {{ .Values.obs.stats.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.obs.stats.resources.requests.cpu | quote }}
+              memory: {{ .Values.obs.stats.resources.requests.memory | quote }}
+        {{- end }}
+      {{- if and .Values.security.tls.enabled (or (not .Values.security.tls.autoGenerated.enabled) (ne .Values.security.tls.autoGenerated.engine "pod")) }}
+      volumes:
+        {{- include "rest_api_tls_client_volume" (dict "ctx" . "secretName" (include "rest_api_tls_callhome_client_secret_name" .)) | nindent 8 }}
+      {{- end }}
+{{- end }}
@@ -0,0 +1,35 @@
+{{- $analytics := false }}
+{{- if kindIs "bool" .Values.global.analytics.enabled }}
+{{- $analytics = .Values.global.analytics.enabled }}
+{{- else }}
+{{- $analytics = .Values.obs.callhome.enabled }}
+{{- end }}
+{{- if $analytics }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-obs-callhome-stats
+  labels:
+    app: obs-callhome
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  ports:
+    - port: 9090
+      name: https
+      targetPort: 9090
+      protocol: TCP
+      {{- if eq .Values.obs.stats.service.type "NodePort" }}
+      nodePort: {{ .Values.obs.stats.service.nodePorts.https }}
+      {{- end }}
+    - port: 9091
+      name: http
+      targetPort: 9091
+      protocol: TCP
+      {{- if eq .Values.obs.stats.service.type "NodePort" }}
+      nodePort: {{ .Values.obs.stats.service.nodePorts.http }}
+      {{- end }}
+  selector:
+    app: obs-callhome
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+{{- end }}
@@ -0,0 +1,31 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled $mutualAuth (eq $tls.autoGenerated.engine "cert-manager") }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "rest_api_tls_diskpool_operator_client_secret_name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: operator-diskpool
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ include "rest_api_tls_diskpool_operator_client_secret_name" . }}
+  commonName: {{ printf "%s-api-rest-diskpool-operator" .Release.Name }}
+  issuerRef:
+    name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+    kind: Issuer
+  subject:
+    organizations:
+      - "OpenEBS"
+  usages:
+    - client auth
+  privateKey:
+    algorithm: {{ $tls.autoGenerated.certManager.keyAlgorithm }}
+    size: {{ int $tls.autoGenerated.certManager.keySize }}
+  duration: {{ $tls.autoGenerated.certManager.duration }}
+  renewBefore: {{ $tls.autoGenerated.certManager.renewBefore }}
+{{- end -}}
@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-operator-diskpool
+  labels:
+    app: operator-diskpool
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: operator-diskpool
+      {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: operator-diskpool
+        {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+        {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+        {{ include "label_prefix" . }}/logging: "true"
+    spec:
+      serviceAccountName: {{ .Release.Name }}-service-account
+      imagePullSecrets:
+        {{- include "base_pull_secrets" . }}
+      initContainers:
+        {{- include "base_init_containers" . }}
+      {{- if $pcName := include "priority_class_with_default" (dict "template" . "localPriorityClass" .Values.operators.pool.priorityClassName) }}
+      priorityClassName: {{ $pcName }}
+      {{- end }}
+      {{- if $nodeSelector := include "node_selector" (dict "template" . "localNodeSelector" .Values.operators.pool.nodeSelector) }}
+      nodeSelector: {{ $nodeSelector }}
+      {{- end }}
+      {{- if $tolerations := include "_tolerations_with_early_eviction" (dict "template" . "localTolerations" .Values.operators.pool.tolerations) }}
+      tolerations: {{ $tolerations }}
+      {{- end }}
+      containers:
+        - name: operator-diskpool
+          resources:
+            limits:
+              cpu: {{ .Values.operators.pool.resources.limits.cpu | quote }}
+              memory: {{ .Values.operators.pool.resources.limits.memory | quote }}
+            requests:
+              cpu: {{ .Values.operators.pool.resources.requests.cpu | quote }}
+              memory: {{ .Values.operators.pool.resources.requests.memory | quote }}
+          image: "{{ default .Values.image.registry .Values.global.imageRegistry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-operator-diskpool:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
+          imagePullPolicy: {{ default .Values.image.pullPolicy .Values.global.imagePullPolicy }}
+          args:
+            - "-e {{ include "rest_api_endpoint" . }}"
+            - "-n{{ .Release.Namespace }}"
+            - "--request-timeout={{ .Values.base.default_req_timeout }}"
+            - "--interval={{ .Values.base.cache_poll_period }}"{{ if .Values.base.jaeger.enabled }}
+            - "--jaeger={{ include "jaeger_url" . }}"{{ end }}
+            - "--ansi-colors={{ .Values.base.logging.color }}"
+            - "--fmt-style={{ include "logFormat" . }}"
+            {{- include "rest_api_tls_client_args" . | nindent 12 }}
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.operators.pool.logLevel }}
+            {{- if default .Values.base.logging.silenceLevel .Values.operators.pool.logSilenceLevel }}
+            - name: RUST_LOG_SILENCE
+              value: {{ default .Values.base.logging.silenceLevel .Values.operators.pool.logSilenceLevel }}
+            {{- end }}
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          {{- if and .Values.security.tls.enabled (or (not .Values.security.tls.autoGenerated.enabled) (ne .Values.security.tls.autoGenerated.engine "pod")) }}
+          volumeMounts:
+            {{- include "rest_api_tls_client_volume_mount" . | nindent 12 }}
+          {{- end }}
+      {{- if and .Values.security.tls.enabled (or (not .Values.security.tls.autoGenerated.enabled) (ne .Values.security.tls.autoGenerated.engine "pod")) }}
+      volumes:
+        {{- include "rest_api_tls_client_volume" (dict "ctx" . "secretName" (include "rest_api_tls_diskpool_operator_client_secret_name" .)) | nindent 8 }}
+      {{- end }}
@@ -0,0 +1,7 @@
+apiVersion: scheduling.k8s.io/v1
+description: Used for critical pods that must run in the cluster, which can be moved to another node if necessary.
+kind: PriorityClass
+metadata:
+  name: {{ .Release.Name }}-cluster-critical
+preemptionPolicy: PreemptLowerPriority
+value: 1000000000
@@ -0,0 +1,131 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-service-account
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-cluster-role
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+rules:
+  # must create mayastor crd if it doesn't exist, replace if exist,
+  # merge schema to existing CRD.
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["create", "get", "update", "list", "patch", "replace"]
+  # must update stored_version in status to include new schema only.
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions/status"]
+  verbs: ["get", "update", "patch"]
+  # must read mayastorpools info. This is needed to handle upgrades from v1.
+- apiGroups: [ "openebs.io" ]
+  resources: [ "mayastorpools" ]
+  verbs: ["get", "list", "patch", "delete", "deletecollection"]
+  # must read diskpool info
+- apiGroups: ["openebs.io"]
+  resources: ["diskpools"]
+  verbs: ["get", "list", "watch", "update", "replace", "patch", "create"]
+  # must update diskpool status
+- apiGroups: ["openebs.io"]
+  resources: ["diskpools/status"]
+  verbs: ["update", "patch"]
+  # must read cm info
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "update", "patch"]
+  # must get deployments info
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "list"]
+  # external provisioner & attacher
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs: ["get", "list", "watch", "update", "create", "delete", "patch"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch", "patch"]
+
+  # external provisioner
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: ["storage.k8s.io"]
+  resources: ["storageclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["list", "watch", "create", "update", "patch"]
+
+  # external-resizer
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims/status"]
+  verbs: ["patch"]
+
+  # external snapshotter and snapshot-controller
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotcontents"]
+  verbs: ["create","get", "list", "watch", "update", "patch", "delete"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotcontents/status"]
+  verbs: ["update", "patch"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshots"]
+  verbs: ["get", "list", "watch", "update", "patch", "delete"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshots/status"]
+  verbs: ["update", "patch"]
+
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
+
+  # external attacher
+- apiGroups: ["storage.k8s.io"]
+  resources: ["volumeattachments"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: ["storage.k8s.io"]
+  resources: ["volumeattachments/status"]
+  verbs: ["patch"]
+  # CSI nodes must be listed
+- apiGroups: ["storage.k8s.io"]
+  resources: ["csinodes"]
+  verbs: ["get", "list", "watch"]
+  # get kube-system namespace to retrieve Uid
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get"]
+
+  # get secrets for encryption
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-cluster-role-binding
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+subjects:
+- kind: ServiceAccount
+  name: {{ .Release.Name }}-service-account
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-cluster-role
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,45 @@
+{{- include "validate_tls_mode" . -}}
+{{- $globalTls := .Values.security.tls -}}
+{{- if and $globalTls.enabled $globalTls.autoGenerated.enabled (eq $globalTls.autoGenerated.engine "cert-manager") }}
+{{- if empty $globalTls.autoGenerated.certManager.existingIssuer }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ .Release.Name }}-tls-clusterissuer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  selfSigned: {}
+---
+{{- end }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ .Release.Name }}-tls-ca-crt
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  secretName: {{ .Release.Name }}-tls-ca-root
+  duration: {{ $globalTls.autoGenerated.certManager.caDuration | quote }}
+  isCA: true
+  commonName: {{ .Release.Name }}-tls-ca-root
+  issuerRef:
+    name: {{ default (printf "%s-tls-clusterissuer" .Release.Name) $globalTls.autoGenerated.certManager.existingIssuer }}
+    kind: {{ default "Issuer" $globalTls.autoGenerated.certManager.existingIssuerKind }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ printf "%s-tls-ca-issuer" .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+spec:
+  ca:
+    secretName: {{ .Release.Name }}-tls-ca-root
+{{- end }}
@@ -0,0 +1,58 @@
+{{- $tls := .Values.security.tls -}}
+{{- $restTls := .Values.apis.rest.security.tls -}}
+{{- if and $tls.enabled $tls.autoGenerated.enabled (eq $tls.autoGenerated.engine "helm") -}}
+{{- $mutualAuth := dig "mutualAuth" $tls.mutualAuth $restTls -}}
+{{- $caCertDuration := int ($tls.autoGenerated.helm.caCertDuration | default 3650) -}}
+{{- $certDuration := $tls.autoGenerated.helm.certDuration | default 365 | int -}}
+
+{{- /* Look up or generate the shared CA.
+     The CA secret stores both cert and key so it can be reused across upgrades and when
+     new services (gRPC, etc.) need leaf certs signed by the same CA.
+     buildCustomCert reconstructs the CA struct that genSignedCert expects from the stored PEM.
+     Note: Kubernetes secret data is already base64-encoded, so no b64dec is needed here.
+     genCA is only called when no CA exists — never generate-then-maybe-overwrite, because
+     if the overwrite were skipped for any reason the fresh random CA would silently replace
+     the stored one, regenerating all leaf certs and breaking mTLS on the next server restart. */ -}}
+{{- $caSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-tls-ca" .Release.Name) -}}
+{{- $caExists := and $caSecret $caSecret.data (index $caSecret.data "ca.crt") (index $caSecret.data "ca.key") -}}
+{{- $ca := "" -}}
+{{- if $caExists -}}
+  {{- $ca = buildCustomCert (index $caSecret.data "ca.crt") (index $caSecret.data "ca.key") -}}
+{{- else -}}
+  {{- $ca = genCA (printf "%s-tls-ca" .Release.Name) $caCertDuration -}}
+{{- end -}}
+
+{{- /* Shared args passed to every tls_helm_leaf_secret call. */ -}}
+{{- $shared := dict "ca" $ca "caExists" $caExists "certDuration" $certDuration "ctx" . -}}
+
+{{- /* DNS SANs cover all the ways the REST service is addressed inside the cluster. */ -}}
+{{- $dnsSANs := list "localhost"
+    (printf "%s-api-rest" .Release.Name)
+    (printf "%s-api-rest.%s.svc" .Release.Name .Release.Namespace)
+    (printf "%s-api-rest.%s.svc.cluster.local" .Release.Name .Release.Namespace)
+    (printf "%s-api-rest.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain) -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-tls-ca
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{ include "label_prefix" . }}/release: {{ .Release.Name }}
+    {{ include "label_prefix" . }}/version: {{ .Chart.Version }}
+type: Opaque
+data:
+  ca.crt: {{ $ca.Cert | b64enc }}
+  ca.key: {{ $ca.Key | b64enc }}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_secret_name" .) "cn" (printf "%s-api-rest" .Release.Name) "dnsSANs" $dnsSANs "app" "api-rest") $shared) | nindent 0 }}
+{{- if $mutualAuth }}
+{{- /* All client certs are emitted here (not in per-client files) so the CA variable is in scope
+     on the very first install — lookup cannot see secrets created in the same render pass. */ -}}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_csi_controller_client_secret_name" .) "cn" (printf "%s-api-rest-csi-controller" .Release.Name) "dnsSANs" (list) "app" "csi-controller") $shared) | nindent 0 }}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_csi_node_client_secret_name" .) "cn" (printf "%s-api-rest-csi-node" .Release.Name) "dnsSANs" (list) "app" "csi-node") $shared) | nindent 0 }}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_callhome_client_secret_name" .) "cn" (printf "%s-api-rest-callhome" .Release.Name) "dnsSANs" (list) "app" "obs-callhome") $shared) | nindent 0 }}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_metrics_exporter_client_secret_name" .) "cn" (printf "%s-api-rest-metrics-exporter" .Release.Name) "dnsSANs" (list) "app" "io-engine") $shared) | nindent 0 }}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_diskpool_operator_client_secret_name" .) "cn" (printf "%s-api-rest-diskpool-operator" .Release.Name) "dnsSANs" (list) "app" "operator-diskpool") $shared) | nindent 0 }}
+{{- include "tls_helm_leaf_secret" (merge (dict "secretName" (include "rest_api_tls_plugin_client_secret_name" .) "cn" (printf "%s-api-rest-plugin" .Release.Name) "dnsSANs" (list "localhost") "app" "plugin") $shared) | nindent 0 }}
+{{- end }}
+{{- end -}}
@@ -0,0 +1,143 @@
+{{- if .Values.preUpgradeHook.enabled }}
+{{- if .Release.IsUpgrade }}
+{{- if include "etcd_is_8.6.0" . }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mayastor-pre-upgrade-hook
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-9999"
+    {{- with .Values.preUpgradeHook.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: mayastor-pre-upgrade-hook
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-9999"
+    {{- with .Values.preUpgradeHook.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["list", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets"]
+    verbs: ["get", "create", "delete", "list", "watch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: mayastor-pre-upgrade-hook
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-9998"
+    {{- with .Values.preUpgradeHook.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+subjects:
+  - kind: ServiceAccount
+    name: mayastor-pre-upgrade-hook
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: mayastor-pre-upgrade-hook
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "mayastor-pre-upgrade-hook"
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-9999"
+    {{- with .Values.preUpgradeHook.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+data:
+  label-etcd-for-helm-release.sh: |-
+    {{- .Files.Get "label-etcd-for-helm-release.sh" | nindent 4 }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "mayastor-pre-upgrade-hook"
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-9997"
+    {{- with .Values.preUpgradeHook.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  template:
+    metadata:
+      name: "mayastor-pre-upgrade-hook"
+      labels:
+        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+        app.kubernetes.io/instance: {{ .Release.Name | quote }}
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+        {{- with .Values.preUpgradeHook.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: "mayastor-pre-upgrade-hook"
+      {{- with .Values.preUpgradeHook.tolerations }}
+      tolerations:
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      restartPolicy: Never
+      volumes:
+        - name: scripts
+          configMap:
+            name: "mayastor-pre-upgrade-hook"
+            defaultMode: 0777
+      containers:
+        - name: mayastor-pre-upgrade-hook
+          image: "{{ default .Values.preUpgradeHook.image.registry .Values.global.imageRegistry }}/{{ .Values.preUpgradeHook.image.repo }}:{{ .Values.preUpgradeHook.image.tag }}"
+          imagePullPolicy: {{ default .Values.preUpgradeHook.image.pullPolicy .Values.global.imagePullPolicy }}
+          command:
+            - "sh"
+            - "-c"
+          args:
+            - "/scripts/label-etcd-for-helm-release.sh {{ .Release.Name }} -n {{ .Release.Namespace }} --rollout-timeout {{ .Values.preUpgradeHook.rolloutTimeout }}"
+          volumeMounts:
+            - name: scripts
+              mountPath: /scripts
+      {{- if or .Values.global.imagePullSecrets .Values.preUpgradeHook.imagePullSecrets }}
+      imagePullSecrets:
+{{- include "mayastor.preUpgradeHook.pullSecrets" . | indent 8 }}
+      {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,22 @@
+{{ if .Values.storageClass.enabled }}
+{{- $scName := (printf "%s-%s" .Release.Name .Values.storageClass.nameSuffix | trunc 63) }}
+kind: StorageClass
+apiVersion: storage.k8s.io/v1
+metadata:
+  name: {{ $scName }}
+  {{- if .Values.storageClass.default }}
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+  {{- end }}
+allowVolumeExpansion: {{ .Values.storageClass.allowVolumeExpansion }}
+parameters:
+{{/*
+  Set StorageClass parameters by adding to the values.yaml 'storageClass.parameters' map.
+  Don't add the parameters to this template directly.
+  This is done so that during an upgrade, an existing default StorageClass's config can
+  be given preference over this chart's defaults.
+*/}}
+{{ $valuesParams := .Values.storageClass.parameters }}
+{{ (include "storageClass.parameters" (list $scName $valuesParams)) | indent 2 }}
+provisioner: io.openebs.csi-mayastor
+{{ end }}