diff --git a/charts/community/mpizarro/librechat/1.8.10/report.yaml b/charts/community/mpizarro/librechat/1.8.10/report.yaml
new file mode 100644
index 000000000..5f42ebb34
--- /dev/null
+++ b/charts/community/mpizarro/librechat/1.8.10/report.yaml
@@ -0,0 +1,150 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: community
+            version: v1.1
+        reportDigest: uint64:12512205562430711204
+        chart-uri: https://maximilianoPizarro.github.io/librechat/librechat-1.8.10.tgz
+        digests:
+            chart: sha256:41bfc8e827813ec6f6fd5bc96bf1a1c5f7ae144474588ae12cba6761f2b4221e
+            package: 316b84e772459b27dd19fcd5519d02d7e01fdca4322d6c1addbcd100c813dcdb
+        lastCertifiedTimestamp: "2025-08-09T05:34:01.898798+00:00"
+        testedOpenShiftVersion: N/A
+        supportedOpenShiftVersions: '>=4.7'
+        webCatalogOnly: false
+    chart:
+        name: librechat
+        home: https://www.librechat.ai
+        sources:
+            - https://github.com/maximilianoPizarro/librechat
+        version: 1.8.10
+        description: A Helm chart for deploying LibreChat, an open-source, AI-powered chat application.
+        keywords:
+            - librechat
+            - chat
+            - ai
+            - llm
+            - chatbot
+            - open-source
+        maintainers:
+            - name: Carlos Estay
+              email: cestay@redhat.com
+              url: ""
+            - name: Maximiliano Pizarro
+              email: mapizarr@redhat.com
+              url: ""
+        icon: https://www.librechat.ai/librechat_alt.svg
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: v0.8.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: LibreChat
+        kubeversion: '>=1.20.0'
+        dependencies:
+            - name: postgresql
+              version: 15.5.38
+              repository: https://charts.bitnami.com/bitnami
+              condition: postgresql.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: mongodb
+              version: 16.3.0
+              repository: https://charts.bitnami.com/bitnami
+              condition: mongodb.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: ollama
+              version: 1.26.0
+              repository: file://./ollama
+              condition: ollama.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: meilisearch
+              version: 0.7.0
+              repository: file://./meilisearch
+              condition: meilisearch.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: librechat-rag-api
+              version: 0.5.1
+              repository: file://./librechat-rag-api
+              condition: librechat-rag-api.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Optional
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/is-helm-v3
+      type: Optional
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Optional
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/images-are-certified
+      type: Optional
+      outcome: FAIL
+      reason: |-
+        Failed to certify images : ghcr.io/bat-bs/bitnami-pgvector:pg16 : No images found for Registry/Repository: ghcr.io/bat-bs/bitnami-pgvector
+        Image is not Red Hat certified : busybox : repository not found: busybox
+        Image is not Red Hat certified : busybox
+        Failed to certify images : ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest : No images found for Registry/Repository: ghcr.io/danny-avila/librechat-rag-api-dev-lite
+        Failed to certify images : docker.io/bitnami/mongodb:8.0.3-debian-12-r0 : No images found for Registry/Repository: docker.io/bitnami/mongodb
+        Image is not Red Hat certified : ollama/ollama:0.11.2 : repository not found: ollama/ollama
+        Image is not Red Hat certified : ollama/ollama:0.11.2
+        Failed to certify images : ghcr.io/danny-avila/librechat:v0.8.0-rc1 : No images found for Registry/Repository: ghcr.io/danny-avila/librechat
+        Image is not Red Hat certified : getmeili/meilisearch:v1.7.3 : repository not found: getmeili/meilisearch
+        Image is not Red Hat certified : getmeili/meilisearch:v1.7.3
+    - check: v1.0/chart-testing
+      type: Optional
+      outcome: FAIL
+      reason: 'invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable'
+    - check: v1.0/has-readme
+      type: Optional
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/not-contain-csi-objects
+      type: Optional
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values
+      type: Optional
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/contains-values-schema
+      type: Optional
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-test
+      type: Optional
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Optional
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+
diff --git a/charts/community/mpizarro/librechat/1.8.14/report.yaml b/charts/community/mpizarro/librechat/1.8.14/report.yaml
new file mode 100644
index 000000000..c035819c3
--- /dev/null
+++ b/charts/community/mpizarro/librechat/1.8.14/report.yaml
@@ -0,0 +1,155 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: community
+            version: v1.1
+        reportDigest: uint64:8743256806177528
+        chart-uri: https://maximilianopizarro.github.io/librechat/librechat-1.8.14.tgz
+        digests:
+            chart: sha256:82446da00e3877e2d87ad07f1e9bd95ae6ee683a4e9d3d70ff5c414f40077feb
+            package: 2b6663528f916e35a344dd3990a759cb5c78225c9f2d316412f58b0ed45c3b85
+        lastCertifiedTimestamp: "2025-09-18T18:32:50.993224+00:00"
+        testedOpenShiftVersion: N/A
+        supportedOpenShiftVersions: '>=4.7'
+        webCatalogOnly: false
+    chart:
+        name: librechat
+        home: https://www.librechat.ai
+        sources:
+            - https://github.com/maximilianoPizarro/librechat
+        version: 1.8.14
+        description: 'A Helm chart for deploying LibreChat, an open-source, AI-powered chat application. Enhanced ChatGPT Clone: Features Agents, MCP, DeepSeek, Anthropic, AWS, OpenAI, Responses API, Azure, Groq, o1, GPT-5, Mistral, OpenRouter, Vertex AI, Gemini, Artifacts, AI model switching, message search, Code Interpreter, langchain, DALL-E-3, OpenAPI Actions, Functions, Secure Multi-User Auth, Presets, open-source for self-hosting. Active.'
+        keywords:
+            - librechat
+            - chat
+            - ai
+            - llm
+            - chatbot
+            - open-source
+        maintainers:
+            - name: Carlos Estay
+              email: cestay@redhat.com
+              url: ""
+            - name: Maximiliano Pizarro
+              email: mapizarr@redhat.com
+              url: ""
+        icon: https://www.librechat.ai/librechat_alt.svg
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: v0.8.0-rc4
+        deprecated: false
+        annotations:
+            charts.openshift.io/documentation-url: https://www.librechat.ai/docs
+            charts.openshift.io/name: LibreChat
+            charts.openshift.io/privacy-policy-url: https://www.librechat.ai/privacy
+            charts.openshift.io/provider-display-name: maximilianoPizarro
+            charts.openshift.io/support-url: https://github.com/maximilianoPizarro/librechat/issues
+            charts.openshift.io/terms-of-service-url: https://www.librechat.ai/terms
+        kubeversion: '>=1.20.0'
+        dependencies:
+            - name: postgresql
+              version: 15.5.38
+              repository: https://charts.bitnami.com/bitnami
+              condition: postgresql.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: mongodb
+              version: 16.5.45
+              repository: https://charts.bitnami.com/bitnami
+              condition: mongodb.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: ollama
+              version: 1.26.0
+              repository: file://./ollama
+              condition: ollama.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: meilisearch
+              version: 0.7.0
+              repository: file://./meilisearch
+              condition: meilisearch.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: librechat-rag-api
+              version: 0.5.1
+              repository: file://./librechat-rag-api
+              condition: librechat-rag-api.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Optional
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Optional
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-values
+      type: Optional
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Optional
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/contains-values-schema
+      type: Optional
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/chart-testing
+      type: Optional
+      outcome: FAIL
+      reason: 'chart Install failure: context deadline exceeded'
+    - check: v1.0/images-are-certified
+      type: Optional
+      outcome: FAIL
+      reason: |-
+        Image is not Red Hat certified : busybox : repository not found: busybox
+        Image is not Red Hat certified : busybox
+        Failed to certify images : ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest : No images found for Registry/Repository: ghcr.io/danny-avila/librechat-rag-api-dev-lite
+        Failed to certify images : docker.io/mongo:8.0.13 : No images found for Registry/Repository: docker.io/mongo
+        Image is not Red Hat certified : ollama/ollama:0.11.2 : repository not found: ollama/ollama
+        Image is not Red Hat certified : ollama/ollama:0.11.2
+        Failed to certify images : ghcr.io/danny-avila/librechat:v0.8.0-rc4 : No images found for Registry/Repository: ghcr.io/danny-avila/librechat
+        Image is not Red Hat certified : getmeili/meilisearch:v1.7.3 : repository not found: getmeili/meilisearch
+        Image is not Red Hat certified : getmeili/meilisearch:v1.7.3
+        Failed to certify images : ghcr.io/bat-bs/bitnami-pgvector:pg16 : No images found for Registry/Repository: ghcr.io/bat-bs/bitnami-pgvector
+    - check: v1.0/contains-test
+      type: Optional
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Optional
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Optional
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Optional
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+
diff --git a/charts/community/mpizarro/librechat/OWNERS b/charts/community/mpizarro/librechat/OWNERS
new file mode 100644
index 000000000..1df81e8dc
--- /dev/null
+++ b/charts/community/mpizarro/librechat/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: librechat
+  shortDescription: A Helm chart for deploying LibreChat, an open-source, AI-powered chat application.
+publicPgpKey: null
+users:
+- githubUsername: maximilianoPizarro
+vendor:
+  label: mpizarro
+  name: Maximiliano Pizarro
\ No newline at end of file
diff --git a/charts/community/mpizarro/mattermost-team-edition/6.6.83/report.yaml b/charts/community/mpizarro/mattermost-team-edition/6.6.83/report.yaml
new file mode 100644
index 000000000..f0fb1b727
--- /dev/null
+++ b/charts/community/mpizarro/mattermost-team-edition/6.6.83/report.yaml
@@ -0,0 +1,115 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: community
+            version: v1.1
+        reportDigest: uint64:3967228565598218398
+        chart-uri: https://maximilianopizarro.github.io/mattermost-helm/mattermost-team-edition-6.6.83.tgz
+        digests:
+            chart: sha256:b0c6d08764cfc1c28e3a3cfdd0c1cda8221f9d824bb27d4a3f681444c1d87825
+            package: bb47d7eb189dfce6211a66913a62655c3f3b3d6e146a0e2a9ff1836a35856057
+        lastCertifiedTimestamp: "2025-09-03T14:15:27.569077+00:00"
+        testedOpenShiftVersion: N/A
+        supportedOpenShiftVersions: '>=4.7'
+        webCatalogOnly: false
+    chart:
+        name: mattermost-team-edition
+        home: https://mattermost.com
+        sources:
+            - https://github.com/mattermost/mattermost-server
+            - https://github.com/mattermost/mattermost-helm
+        version: 6.6.83
+        description: Mattermost Team Edition is an open-source, self-hosted messaging platform for teams. It offers a free, community-driven solution for secure, private collaboration. Features include group and direct messaging, file sharing, and powerful search, giving your team a modern communication hub.
+        keywords:
+            - mattermost
+            - communication
+            - team collaboration
+        maintainers:
+            - name: Maximiliano Pizarro
+              email: maximiliano.pizarro.5@gmail.com
+              url: http://www.linkedin.com/in/maximiliano-gregorio-pizarro-consultor-it
+        icon: http://www.mattermost.org/wp-content/uploads/2016/04/icon.png
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 10.11.2
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: mattermost
+        kubeversion: '>=1.20.0'
+        dependencies:
+            - name: mysql
+              version: 1.6.4
+              repository: https://charts.helm.sh/stable
+              condition: mysql.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/chart-testing
+      type: Optional
+      outcome: FAIL
+      reason: 'chart Install failure: Unable to continue with install: Service "mattermost-team-edition" in namespace "mattermost" exists and cannot be imported into the current release: invalid ownership metadata; annotation validation error: key "meta.helm.sh/release-name" must equal "mattermost-team-edition-vd85m9casf": current value is "mattermost-team-edition"'
+    - check: v1.0/contains-values
+      type: Optional
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-readme
+      type: Optional
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-test
+      type: Optional
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Optional
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/images-are-certified
+      type: Optional
+      outcome: FAIL
+      reason: |-
+        Image is not Red Hat certified : mysql:8.0.18 : repository not found: mysql
+        Image is not Red Hat certified : mysql:8.0.18
+        Image is not Red Hat certified : appropriate/curl:latest : repository not found: appropriate/curl
+        Image is not Red Hat certified : appropriate/curl:latest
+        Image is not Red Hat certified : mattermost/mattermost-team-edition:10.11.2@sha256:b8bd1246cb3a92557891254a4322276206ce12451d3c8581fe2ead4786fd2673 : repository not found: mattermost/mattermost-team-edition:10.11.2
+        Image is not Red Hat certified : mattermost/mattermost-team-edition:10.11.2@sha256:b8bd1246cb3a92557891254a4322276206ce12451d3c8581fe2ead4786fd2673
+        Image is not Red Hat certified : bats/bats:v1.1.0 : repository not found: bats/bats
+        Image is not Red Hat certified : bats/bats:v1.1.0
+        Image is not Red Hat certified : busybox:1.31.1 : repository not found: busybox
+        Image is not Red Hat certified : busybox:1.31.1
+        Image is not Red Hat certified : busybox : repository not found: busybox
+        Image is not Red Hat certified : busybox
+    - check: v1.0/is-helm-v3
+      type: Optional
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contains-crds
+      type: Optional
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.1/has-kubeversion
+      type: Optional
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contain-csi-objects
+      type: Optional
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/required-annotations-present
+      type: Optional
+      outcome: PASS
+      reason: All required annotations present
+
diff --git a/charts/community/mpizarro/mattermost-team-edition/OWNERS b/charts/community/mpizarro/mattermost-team-edition/OWNERS
new file mode 100644
index 000000000..e25eb203a
--- /dev/null
+++ b/charts/community/mpizarro/mattermost-team-edition/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: mattermost-team-edition
+  shortDescription: Mattermost Team Edition is an open-source, self-hosted messaging platform for teams. It offers a free, community-driven solution for secure, private collaboration. Features include group and direct messaging, file sharing, and powerful search, giving your team a modern communication hub.
+publicPgpKey: null
+users:
+- githubUsername: maximilianoPizarro
+vendor:
+  label: mpizarro
+  name: Maximiliano Pizarro
\ No newline at end of file
diff --git a/charts/community/mpizarro/n8n/1.14.2/report.yaml b/charts/community/mpizarro/n8n/1.14.2/report.yaml
new file mode 100644
index 000000000..329ffe445
--- /dev/null
+++ b/charts/community/mpizarro/n8n/1.14.2/report.yaml
@@ -0,0 +1,203 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: community
+            version: v1.1
+        reportDigest: uint64:5101787987969041959
+        chart-uri: https://github.com/community-charts/helm-charts/releases/download/n8n-1.14.2/n8n-1.14.2.tgz
+        digests:
+            chart: sha256:ea8ee551656c3875cdd64bdfb73111ebba087fad9f557b947a78ebce86845f41
+            package: 060d4a7533a77072fe715cc3ce2743e56b0101f2c8fc303fd8100c57565fa7e2
+        lastCertifiedTimestamp: "2025-08-19T14:34:16.906804+00:00"
+        testedOpenShiftVersion: N/A
+        supportedOpenShiftVersions: '>=4.10'
+        webCatalogOnly: false
+    chart:
+        name: n8n
+        home: https://n8n.io
+        sources:
+            - https://github.com/community-charts/helm-charts
+            - https://github.com/n8n-io/n8n
+        version: 1.14.2
+        description: A Helm chart for fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.
+        keywords:
+            - n8n
+            - Workflow Automation
+            - Workflow
+            - Automation
+            - iPaaS
+            - integration-framework
+            - low-code-plattform
+            - low-code
+        maintainers:
+            - name: burakince
+              email: burak.ince@linux.org.tr
+              url: https://www.burakince.com
+        icon: https://avatars1.githubusercontent.com/u/45487711?s=200&v=4
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 1.107.3
+        deprecated: false
+        annotations:
+            artifacthub.io/changes: |-
+                - kind: changed
+                  description: Update n8nio/n8n image version to 1.107.3
+                  links:
+                    - name: Upstream Project
+                      url: https://github.com/n8n-io/n8n
+                - kind: changed
+                  description: Update dependency redis from 22.0.1 to 22.0.4
+                  links:
+                    - name: ArtifactHub
+                      url: https://artifacthub.io/packages/helm/bitnami/redis
+                - kind: changed
+                  description: Update dependency postgresql from 16.7.24 to 16.7.26
+                  links:
+                    - name: ArtifactHub
+                      url: https://artifacthub.io/packages/helm/bitnami/postgresql
+            artifacthub.io/containsSecurityUpdates: "false"
+            artifacthub.io/images: |
+                - name: n8n
+                  image: n8nio/n8n:1.107.3
+                  platforms:
+                    - linux/amd64
+                    - linux/arm64
+            artifacthub.io/license: Apache-2.0
+            artifacthub.io/links: |
+                - name: Chart Source
+                  url: https://github.com/community-charts/helm-charts
+                - name: Chart Usage Page
+                  url: https://community-charts.github.io/docs/charts/n8n/usage
+                - name: Upstream Project
+                  url: https://github.com/n8n-io/n8n
+                - name: Official Documentation
+                  url: https://docs.n8n.io/
+            artifacthub.io/maintainers: |
+                - name: burakince
+                  email: burak.ince@linux.org.tr
+            artifacthub.io/operator: "false"
+            artifacthub.io/prerelease: "false"
+            artifacthub.io/screenshots: |
+                - title: Editor UI Walkthrough
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-one/editor-ui-walkthrough.gif
+                - title: Node Menu Drilldown
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-one/l1-c1-node-menu-drilldown.gif
+                - title: Adding a Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-one/l1-c1-add-node-click.gif
+                - title: Node Buttons
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-one/node-buttons.gif
+                - title: Nathans Workflow
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-four/l1-c4-nathans-workflow.png
+                - title: Set Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-five/l1-c5-4-set-node.png
+                - title: Workflow with Set Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-five/l1-c5-4-workflow-with-set-node.png
+                - title: Code Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-five/l1-c5-5-5-code-node.png
+                - title: Discord Output
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-one/chapter-five/l1-c5-5-6-discord-output.png
+                - title: Exercise Function
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-one/exercise_function.png
+                - title: Exercise Function Not Nested
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-one/exercise_function_notnested.png
+                - title: Exercise Function Reference
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-one/exercise_function_reference.png
+                - title: HTTP Request Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-two/exercise_html_httprequestnode.png
+                - title: HTTP Extraction Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-two/exercise_html_htmlextractnode.png
+                - title: Binary Data HTTP Request Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-two/exercise_binarydata_httprequest_file.png
+                - title: Binary to JSON Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-two/exercise_binarydata_movedata_btoj.png
+                - title: JSON to XML Node
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-two/exercise_html_xmlnode_table.png
+                - title: Workflow
+                  url: https://raw.githubusercontent.com/n8n-io/n8n-docs/refs/heads/main/docs/_images/courses/level-two/chapter-five/workflow2.png
+            artifacthub.io/signKey: |
+                fingerprint: 939B1A0ED8AAA8E722ACCDB3B6A012EE8A76426A
+                url: https://keybase.io/communitycharts/pgp_keys.asc
+        kubeversion: '>=1.23.0-0'
+        dependencies:
+            - name: redis
+              version: 22.0.4
+              repository: https://charts.bitnami.com/bitnami
+              condition: redis.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: postgresql
+              version: 16.7.26
+              repository: https://charts.bitnami.com/bitnami
+              condition: postgresql.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: minio
+              version: 5.4.0
+              repository: https://charts.min.io/
+              condition: minio.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-readme
+      type: Optional
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-test
+      type: Optional
+      outcome: FAIL
+      reason: Chart test files do not exist
+    - check: v1.0/images-are-certified
+      type: Optional
+      outcome: FAIL
+      reason: |-
+        Image is not Red Hat certified : n8nio/n8n:1.107.3 : repository not found: n8nio/n8n
+        Image is not Red Hat certified : n8nio/n8n:1.107.3
+    - check: v1.0/is-helm-v3
+      type: Optional
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Optional
+      outcome: FAIL
+      reason: 'Missing required annotations: [charts.openshift.io/name]'
+    - check: v1.1/has-kubeversion
+      type: Optional
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contains-crds
+      type: Optional
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values
+      type: Optional
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/contains-values-schema
+      type: Optional
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/chart-testing
+      type: Optional
+      outcome: FAIL
+      reason: 'invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable'
+    - check: v1.0/not-contain-csi-objects
+      type: Optional
+      outcome: PASS
+      reason: CSI objects do not exist
+
diff --git a/charts/community/mpizarro/n8n/1.15.5/report.yaml b/charts/community/mpizarro/n8n/1.15.5/report.yaml
new file mode 100644
index 000000000..9aaaca617
--- /dev/null
+++ b/charts/community/mpizarro/n8n/1.15.5/report.yaml
@@ -0,0 +1,118 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: community
+            version: v1.1
+        reportDigest: uint64:3770131789488719524
+        chart-uri: https://maximilianopizarro.github.io/n8n-helm-chart/n8n-1.15.5.tgz
+        digests:
+            chart: sha256:93f10d30cfb4397e8a373e7fdd90e7d5134d54d33a438df702ae5e93c782c33f
+            package: 6710b9116a58ee8e803cbbe9c7f724194e9292db144c822ac4207392897e8b56
+        lastCertifiedTimestamp: "2025-09-09T22:42:29.85684+00:00"
+        testedOpenShiftVersion: N/A
+        supportedOpenShiftVersions: '>=4.7'
+        webCatalogOnly: false
+    chart:
+        name: n8n
+        home: https://github.com/maximilianoPizarro/n8n-helm-chart
+        sources:
+            - https://github.com/maximilianoPizarro/n8n-helm-chart
+            - https://github.com/n8n-io/n8n
+            - https://n8n.io/
+        version: 1.15.5
+        description: Helm Chart for deploying n8n on Kubernetes, a fair-code workflow automation platform with native AI capabilities for technical teams. Easily automate tasks across different services.
+        keywords:
+            - Workflow Automation
+            - Workflow
+            - iPaaS
+            - integration-framework
+            - low-code-plattform
+            - low-code
+        maintainers:
+            - name: maximilianoPizarro
+              email: maximiliano.pizarro.5@gmail.com
+              url: https://github.com/maximilianoPizarro
+            - name: n8n
+              email: _@8gears.com
+              url: https://github.com/n8n-io
+        icon: https://avatars1.githubusercontent.com/u/45487711?s=200&v=4
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 1.109.1
+        deprecated: false
+        annotations:
+            artifacthub.io/changes: |
+                - kind: changed
+                  description: "Update n8n app version to 1.109.1"
+            artifacthub.io/prerelease: "false"
+            charts.openshift.io/name: n8n
+        kubeversion: '>=1.20.0'
+        dependencies:
+            - name: valkey
+              version: 2.4.7
+              repository: oci://registry-1.docker.io/bitnamicharts
+              condition: valkey.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Optional
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-test
+      type: Optional
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/images-are-certified
+      type: Optional
+      outcome: FAIL
+      reason: |-
+        Image is not Red Hat certified : n8nio/n8n:1.109.1 : repository not found: n8nio/n8n
+        Image is not Red Hat certified : n8nio/n8n:1.109.1
+        Image is not Red Hat certified : alpine : repository not found: alpine
+        Image is not Red Hat certified : alpine
+    - check: v1.0/not-contain-csi-objects
+      type: Optional
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values
+      type: Optional
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-readme
+      type: Optional
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Optional
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-values-schema
+      type: Optional
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Optional
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/required-annotations-present
+      type: Optional
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Optional
+      outcome: FAIL
+      reason: 'chart Install failure: Unable to continue with install: ServiceAccount "n8n-sa" in namespace "n8n" exists and cannot be imported into the current release: invalid ownership metadata; annotation validation error: key "meta.helm.sh/release-name" must equal "n8n-jj4qlx9z6p": current value is "n8n"'
+
diff --git a/charts/community/mpizarro/n8n/OWNERS b/charts/community/mpizarro/n8n/OWNERS
new file mode 100644
index 000000000..3bdcde17a
--- /dev/null
+++ b/charts/community/mpizarro/n8n/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: n8n
+  shortDescription: A Helm chart for fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.
+publicPgpKey: null
+users:
+- githubUsername: maximilianoPizarro
+vendor:
+  label: mpizarro
+  name: Maximiliano Pizarro
\ No newline at end of file
diff --git a/charts/partners/6046316dac3db97929ca740b/core-helm/OWNERS b/charts/partners/6046316dac3db97929ca740b/core-helm/OWNERS
new file mode 100644
index 000000000..532872647
--- /dev/null
+++ b/charts/partners/6046316dac3db97929ca740b/core-helm/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: core-helm
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: 6046316dac3db97929ca740b
+  name: CUMUCORE
diff --git a/charts/partners/6046316dac3db97929ca740b/core/OWNERS b/charts/partners/6046316dac3db97929ca740b/core/OWNERS
new file mode 100644
index 000000000..b0a27fa8e
--- /dev/null
+++ b/charts/partners/6046316dac3db97929ca740b/core/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: core
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: 6046316dac3db97929ca740b
+  name: CUMUCORE
diff --git a/charts/partners/60f17aa380cc9b7e0a99d5fa/ngvoice-ims-core/OWNERS b/charts/partners/60f17aa380cc9b7e0a99d5fa/ngvoice-ims-core/OWNERS
new file mode 100644
index 000000000..8bbe6afbf
--- /dev/null
+++ b/charts/partners/60f17aa380cc9b7e0a99d5fa/ngvoice-ims-core/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: ngvoice-ims-core
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: 60f17aa380cc9b7e0a99d5fa
+  name: ng-voice GmbH
diff --git a/charts/partners/61958d07f5a0de0193e7860d/wavefront-collector-helm-test/OWNERS b/charts/partners/61958d07f5a0de0193e7860d/wavefront-collector-helm-test/OWNERS
new file mode 100644
index 000000000..a718b09e9
--- /dev/null
+++ b/charts/partners/61958d07f5a0de0193e7860d/wavefront-collector-helm-test/OWNERS
@@ -0,0 +1,10 @@
+chart:
+  name: wavefront-collector-helm-test
+  shortDescription: Wavefront Collector for Kubernetes
+providerDelivery: false
+publicPgpKey: unknown
+users:
+- githubUsername: mamichael@vmware.com
+vendor:
+  label: 61958d07f5a0de0193e7860d
+  name: Vmware, Inc.
diff --git a/charts/partners/61c4cabb4841f1221d7676be/kyndryl-aml/OWNERS b/charts/partners/61c4cabb4841f1221d7676be/kyndryl-aml/OWNERS
new file mode 100644
index 000000000..11718769a
--- /dev/null
+++ b/charts/partners/61c4cabb4841f1221d7676be/kyndryl-aml/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: kyndryl-aml
+  shortDescription: unknown
+providerDelivery: true
+publicPgpKey: unknown
+users: []
+vendor:
+  label: 61c4cabb4841f1221d7676be
+  name: Kyndryl Poland Sp. z o.o.
diff --git a/charts/partners/61cb8b3c80cc9b10e948181e/cloudguard/OWNERS b/charts/partners/61cb8b3c80cc9b10e948181e/cloudguard/OWNERS
new file mode 100644
index 000000000..3a7483914
--- /dev/null
+++ b/charts/partners/61cb8b3c80cc9b10e948181e/cloudguard/OWNERS
@@ -0,0 +1,11 @@
+chart:
+  name: cloudguard
+  shortDescription: Check Point CNAPP CloudGuard Helm Chart
+providerDelivery: false
+publicPgpKey: unknown
+users:
+- githubUsername: chkp-alexgl
+- githubUsername: chkp-rigor
+vendor:
+  label: 61cb8b3c80cc9b10e948181e
+  name: Check Point Software Technologies, Inc.
diff --git a/charts/partners/a10networks/a10tkc/OWNERS b/charts/partners/a10networks/a10tkc/OWNERS
index c299215db..f2afc8634 100644
--- a/charts/partners/a10networks/a10tkc/OWNERS
+++ b/charts/partners/a10networks/a10tkc/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: a10tkc
   shortDescription: Helm Chart for Installing A10 Thunder Kubernetes Connector
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: csingh-a10
 vendor:
diff --git a/charts/partners/alquimiaai/alquimia-runtime-helm/OWNERS b/charts/partners/alquimiaai/alquimia-runtime-helm/OWNERS
index fc395becc..1d6d403ee 100644
--- a/charts/partners/alquimiaai/alquimia-runtime-helm/OWNERS
+++ b/charts/partners/alquimiaai/alquimia-runtime-helm/OWNERS
@@ -4,8 +4,7 @@ chart:
 providerDelivery: false
 publicPgpKey: unknown
 users:
-- githubUsername: jlcruzfiveit
 - githubUsername: joseluiscruz-alquimiaai
 vendor:
   label: alquimiaai
-  name: Alquimia S.A.
+  name: Alquimia AI US Corp.
diff --git a/charts/partners/axual/axual-governance-core/1.2.0/axual-governance-core-1.2.0.tgz b/charts/partners/axual/axual-governance-core/1.2.0/axual-governance-core-1.2.0.tgz
new file mode 100644
index 000000000..102baec60
Binary files /dev/null and b/charts/partners/axual/axual-governance-core/1.2.0/axual-governance-core-1.2.0.tgz differ
diff --git a/charts/partners/axual/axual-governance-core/1.2.0/report.yaml b/charts/partners/axual/axual-governance-core/1.2.0/report.yaml
new file mode 100644
index 000000000..03d1c7e81
--- /dev/null
+++ b/charts/partners/axual/axual-governance-core/1.2.0/report.yaml
@@ -0,0 +1,139 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.8
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:16523233768077626543
+        chart-uri: /charts/axual-governance-core-1.2.0.tgz
+        digests:
+            chart: sha256:40f7fbbd2b9d3d6046c135f612bde03cf21b068eaf90ee99bc02d4196991141c
+            package: 2be3461660a2db711fe43c34df0e5567e520648d2eca71c045d5ec87ac68ae06
+        lastCertifiedTimestamp: "2025-09-29T16:01:43.807216+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.11'
+        webCatalogOnly: false
+    chart:
+        name: axual-governance-core
+        home: https://axual.com
+        sources: []
+        version: 1.2.0
+        description: Axual Governance Core charts which install core Axual components defining the control plane.
+        keywords:
+            - axual
+            - kafka
+            - messaging
+            - integration
+            - streaming
+        maintainers: []
+        icon: https://media.licdn.com/dms/image/C560BAQGNVRrjMGHmxQ/company-logo_200_200/0/1630600168205/axual_logo?e=2147483647&v=beta&t=NlepYScz7uLBwI1tawUVoq-wo1-qZdvA4LCzvH8mf5c
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: '"2025.3"'
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Axual Governance
+        kubeversion: '>= 1.24.0'
+        dependencies:
+            - name: platform-manager
+              version: 12.0.0
+              repository: oci://registry.axual.io/axual-charts
+              condition: global.platform-manager.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform-ui
+              version: 10.5.0
+              repository: oci://registry.axual.io/axual-charts
+              condition: global.platform-ui.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: api-gateway
+              version: 0.7.0
+              repository: oci://registry.axual.io/axual-charts
+              condition: global.api-gateway.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: topic-browse
+              version: 0.5.1
+              repository: oci://registry.axual.io/axual-charts
+              condition: global.topic-browse.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: metrics-exposer
+              version: 1.3.2
+              repository: oci://registry.axual.io/axual-charts
+              condition: global.metrics-exposer.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: No images to certify
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
diff --git a/charts/partners/bpm-test-registry-namespace/chart-external-prod/OWNERS b/charts/partners/bpm-test-registry-namespace/chart-external-prod/OWNERS
index 758339cb0..4838acccb 100644
--- a/charts/partners/bpm-test-registry-namespace/chart-external-prod/OWNERS
+++ b/charts/partners/bpm-test-registry-namespace/chart-external-prod/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: chart-external-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: sawalgiriraj
 vendor:
diff --git a/charts/partners/bpm-test-registry-namespace/chart-internal-prod/OWNERS b/charts/partners/bpm-test-registry-namespace/chart-internal-prod/OWNERS
index a9a4843a3..dec3ff6fe 100644
--- a/charts/partners/bpm-test-registry-namespace/chart-internal-prod/OWNERS
+++ b/charts/partners/bpm-test-registry-namespace/chart-internal-prod/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: chart-internal-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: sawalgiriraj
 vendor:
diff --git a/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019053/OWNERS b/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019053/OWNERS
index a03a0a7fd..dad0119ce 100644
--- a/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019053/OWNERS
+++ b/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019053/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: helm-chart-internal-1627019053
   shortDescription: Test Helm Chart Short DESC
+providerDelivery: false
 publicPgpKey: MTIzNDU2Nzg5MA==
 users:
 - githubUsername: sawalgiriraj
diff --git a/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019310/OWNERS b/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019310/OWNERS
index e70d5934b..d4fe9155a 100644
--- a/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019310/OWNERS
+++ b/charts/partners/bpm-test-registry-namespace/helm-chart-internal-1627019310/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: helm-chart-internal-1627019310
   shortDescription: Test Helm Chart Short DESC
+providerDelivery: false
 publicPgpKey: MTIzNDU2Nzg5MA==
 users:
 - githubUsername: sawalgiriraj
diff --git a/charts/partners/bpm-test-registry-namespace/prodtest/OWNERS b/charts/partners/bpm-test-registry-namespace/prodtest/OWNERS
index 18d03a205..e4495047a 100644
--- a/charts/partners/bpm-test-registry-namespace/prodtest/OWNERS
+++ b/charts/partners/bpm-test-registry-namespace/prodtest/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: prodtest
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/bpm-test-registry-namespace/test-2102/OWNERS b/charts/partners/bpm-test-registry-namespace/test-2102/OWNERS
index 6ea6c40e3..5cc92ffdc 100644
--- a/charts/partners/bpm-test-registry-namespace/test-2102/OWNERS
+++ b/charts/partners/bpm-test-registry-namespace/test-2102/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: test-2102
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/broadpeak/bks400/OWNERS b/charts/partners/broadpeak/bks400/OWNERS
index 90d09928e..65d1d6e6e 100644
--- a/charts/partners/broadpeak/bks400/OWNERS
+++ b/charts/partners/broadpeak/bks400/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: bks400
   shortDescription: Broadpeak BkS400 Edge CDN
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: bpkrichardv
 vendor:
diff --git a/charts/partners/c3-ai/c3-cluster/OWNERS b/charts/partners/c3-ai/c3-cluster/OWNERS
index 98a640ad2..f34b018a8 100644
--- a/charts/partners/c3-ai/c3-cluster/OWNERS
+++ b/charts/partners/c3-ai/c3-cluster/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: c3-cluster
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: c3ivodujmovic
 - githubUsername: c3-shiva
diff --git a/charts/partners/ca/uma/OWNERS b/charts/partners/ca/uma/OWNERS
index ac7fcd112..76c664e19 100644
--- a/charts/partners/ca/uma/OWNERS
+++ b/charts/partners/ca/uma/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: uma
   shortDescription: Helm-charts for uma
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: mn660971
 vendor:
diff --git a/charts/partners/castai/castai-agent/OWNERS b/charts/partners/castai/castai-agent/OWNERS
index f94bbcd82..1030e78d6 100644
--- a/charts/partners/castai/castai-agent/OWNERS
+++ b/charts/partners/castai/castai-agent/OWNERS
@@ -3,7 +3,7 @@ chart:
   shortDescription: 'CAST AI Repository for helm charts to operate the CAST AI Kubernetes
     automation platform. '
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: zilvinasu
 vendor:
diff --git a/charts/partners/catalogicsoftware/cloudcasa/OWNERS b/charts/partners/catalogicsoftware/cloudcasa/OWNERS
index 94eafa35b..560bbdb79 100644
--- a/charts/partners/catalogicsoftware/cloudcasa/OWNERS
+++ b/charts/partners/catalogicsoftware/cloudcasa/OWNERS
@@ -1,10 +1,9 @@
 chart:
   name: cloudcasa
-  shortDescription: CloudCasa agent Helm chart
+  shortDescription: unknown
 providerDelivery: false
 publicPgpKey: unknown
-users:
-- githubUsername: bobadair
+users: []
 vendor:
   label: catalogicsoftware
   name: Catalogic Software
diff --git a/charts/partners/certpm-test-partner/gitbook/OWNERS b/charts/partners/certpm-test-partner/gitbook/OWNERS
index 0706c0f9c..fba0564d6 100644
--- a/charts/partners/certpm-test-partner/gitbook/OWNERS
+++ b/charts/partners/certpm-test-partner/gitbook/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: gitbook
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/certpm-test-partner/helm-chart-doc/OWNERS b/charts/partners/certpm-test-partner/helm-chart-doc/OWNERS
index bb1868c8d..3d12dfe03 100644
--- a/charts/partners/certpm-test-partner/helm-chart-doc/OWNERS
+++ b/charts/partners/certpm-test-partner/helm-chart-doc/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: helm-chart-doc
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/certpm-test-partner/test-helm-chart-new/OWNERS b/charts/partners/certpm-test-partner/test-helm-chart-new/OWNERS
index c490a82e3..1d11eeb29 100644
--- a/charts/partners/certpm-test-partner/test-helm-chart-new/OWNERS
+++ b/charts/partners/certpm-test-partner/test-helm-chart-new/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: test-helm-chart-new
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: marcorandria+github@gmail.com
 vendor:
diff --git a/charts/partners/cloudcastles/cc-ubi8-hw/OWNERS b/charts/partners/cloudcastles/cc-ubi8-hw/OWNERS
index f9ad85d1d..3da04b8ce 100644
--- a/charts/partners/cloudcastles/cc-ubi8-hw/OWNERS
+++ b/charts/partners/cloudcastles/cc-ubi8-hw/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: cc-ubi8-hw
   shortDescription: Basic helm chart for cc sample application
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: vrvaderom
 vendor:
diff --git a/charts/partners/cpd/wmla231/OWNERS b/charts/partners/cpd/wmla231/OWNERS
index abb205ef8..8cde3e2d3 100644
--- a/charts/partners/cpd/wmla231/OWNERS
+++ b/charts/partners/cpd/wmla231/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: wmla231
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/datacore-software/puls8/OWNERS b/charts/partners/datacore-software/puls8/OWNERS
new file mode 100644
index 000000000..ed29c57d1
--- /dev/null
+++ b/charts/partners/datacore-software/puls8/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: puls8
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: datacore-software
+  name: Datacore Software
diff --git a/charts/partners/dh2i/dxemssql/OWNERS b/charts/partners/dh2i/dxemssql/OWNERS
index 75aea0ac2..dfec37af2 100644
--- a/charts/partners/dh2i/dxemssql/OWNERS
+++ b/charts/partners/dh2i/dxemssql/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: dxemssql
   shortDescription: Helm chart for DxEnterprise + SQL Server sidecar container deployment
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: dh2i-devs
 vendor:
diff --git a/charts/partners/diffgram/diffgram-helm/OWNERS b/charts/partners/diffgram/diffgram-helm/OWNERS
index 39850eb71..e03dcfabf 100644
--- a/charts/partners/diffgram/diffgram-helm/OWNERS
+++ b/charts/partners/diffgram/diffgram-helm/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: diffgram-helm
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: anthony-sarkis
 vendor:
diff --git a/charts/partners/enclaive/vhsm/0.29.0/report.yaml b/charts/partners/enclaive/vhsm/0.29.0/report.yaml
new file mode 100644
index 000000000..fd0dbf329
--- /dev/null
+++ b/charts/partners/enclaive/vhsm/0.29.0/report.yaml
@@ -0,0 +1,103 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:14456852576257879128
+        chart-uri: vhsm-0.29.0.tgz
+        digests:
+            chart: sha256:5f1bc27fd08754f1e97a5ba5326501ef5dae1ef42a2a64974717c0128605d7ea
+            package: 23c66904fc799f7cfa34afb83e6d1eab5d392ee2e491fd622ebb76f8cec9c601
+        lastCertifiedTimestamp: "2025-09-08T10:41:26.191558+00:00"
+        testedOpenShiftVersion: "4.19"
+        supportedOpenShiftVersions: '>=4.7'
+        webCatalogOnly: false
+    chart:
+        name: vhsm
+        home: https://www.enclaive.io
+        sources:
+            - https://github.com/enclaive/vhsm
+            - https://github.com/enclaive/vhsm-helm
+        version: 0.29.0
+        description: Official Enclaive vHSM Chart
+        keywords:
+            - vhsm
+            - security
+            - encryption
+            - secrets
+            - management
+            - automation
+            - infrastructure
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 1.4.4-1
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Enclaive vHSM
+        kubeversion: '>= 1.20.0-0'
+        dependencies: []
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : quay.io/enclaive/vhsm:v1.4.4-1'
diff --git a/charts/partners/enclaive/vhsm/0.29.0/vhsm-0.29.0.tgz b/charts/partners/enclaive/vhsm/0.29.0/vhsm-0.29.0.tgz
new file mode 100644
index 000000000..36cd9b8ab
Binary files /dev/null and b/charts/partners/enclaive/vhsm/0.29.0/vhsm-0.29.0.tgz differ
diff --git a/charts/partners/enclaive/vhsm/OWNERS b/charts/partners/enclaive/vhsm/OWNERS
new file mode 100644
index 000000000..008006943
--- /dev/null
+++ b/charts/partners/enclaive/vhsm/OWNERS
@@ -0,0 +1,12 @@
+chart:
+  name: vhsm
+  shortDescription: The official enclaive Helm chart for installing and configuring
+    vHSM on OpenShift
+providerDelivery: false
+publicPgpKey: unknown
+users:
+- githubUsername: sebastiangajek
+- githubUsername: klassiker
+vendor:
+  label: enclaive
+  name: enclaive GmbH
diff --git a/charts/partners/exate/exateapigator/OWNERS b/charts/partners/exate/exateapigator/OWNERS
index 3b102967e..04435baa1 100644
--- a/charts/partners/exate/exateapigator/OWNERS
+++ b/charts/partners/exate/exateapigator/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: exateapigator
   shortDescription: eXate APIgator deployment
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: zeeshanAt
 vendor:
diff --git a/charts/partners/exfo/uverifier/OWNERS b/charts/partners/exfo/uverifier/OWNERS
index 50f6334cf..b9824b2c9 100644
--- a/charts/partners/exfo/uverifier/OWNERS
+++ b/charts/partners/exfo/uverifier/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: uverifier
   shortDescription: Nova u-Verifier helm chart
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: arasyid-aziz
 vendor:
diff --git a/charts/partners/fiware/orion-ld/OWNERS b/charts/partners/fiware/orion-ld/OWNERS
index 08a12590d..315055c40 100644
--- a/charts/partners/fiware/orion-ld/OWNERS
+++ b/charts/partners/fiware/orion-ld/OWNERS
@@ -2,7 +2,8 @@ chart:
   name: orion-ld
   shortDescription: Context Broker and CEF building block for context data management
     which supports both the NGSI-LD and the NGSI-v2 APIs.
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: wistefan
 vendor:
diff --git a/charts/partners/flomesh/flomesh-console/OWNERS b/charts/partners/flomesh/flomesh-console/OWNERS
index 7a9a2aae3..2720dcd11 100644
--- a/charts/partners/flomesh/flomesh-console/OWNERS
+++ b/charts/partners/flomesh/flomesh-console/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: flomesh-console
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: nixff
 vendor:
diff --git a/charts/partners/flomesh/fsm/OWNERS b/charts/partners/flomesh/fsm/OWNERS
index bfa19f0db..02c89e862 100644
--- a/charts/partners/flomesh/fsm/OWNERS
+++ b/charts/partners/flomesh/fsm/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: fsm
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: reaver-flomesh
 vendor:
diff --git a/charts/partners/flomesh/osm-edge/OWNERS b/charts/partners/flomesh/osm-edge/OWNERS
index 8f8e08737..81245a66a 100644
--- a/charts/partners/flomesh/osm-edge/OWNERS
+++ b/charts/partners/flomesh/osm-edge/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: osm-edge
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: cybwan
 vendor:
diff --git a/charts/partners/fortanix/dsm-secrets-injector-chart/OWNERS b/charts/partners/fortanix/dsm-secrets-injector-chart/OWNERS
index f18049690..ee64698dd 100644
--- a/charts/partners/fortanix/dsm-secrets-injector-chart/OWNERS
+++ b/charts/partners/fortanix/dsm-secrets-injector-chart/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: dsm-secrets-injector-chart
   shortDescription: Helm Charts for Fortanix DSM Secrets Injector
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: frankus0512
 - githubUsername: manasag
diff --git a/charts/partners/gitlab/gitlab/OWNERS b/charts/partners/gitlab/gitlab/OWNERS
index a6d6b2e95..f4f98cbbf 100644
--- a/charts/partners/gitlab/gitlab/OWNERS
+++ b/charts/partners/gitlab/gitlab/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: gitlab
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: hickey
 vendor:
diff --git a/charts/partners/granulate/sagent/OWNERS b/charts/partners/granulate/sagent/OWNERS
index 01f4b8017..5e2dd2251 100644
--- a/charts/partners/granulate/sagent/OWNERS
+++ b/charts/partners/granulate/sagent/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: sagent
   shortDescription: Granulate sAgent agent
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: shaharshitrit
 vendor:
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/.helmignore b/charts/partners/hashicorp/vault/0.31.0/src/.helmignore
new file mode 100644
index 000000000..18dbc2bcd
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/.helmignore
@@ -0,0 +1,29 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.terraform/
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+
+# CI and test
+.circleci/
+.github/
+.gitlab-ci.yml
+test/
+scratch/
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/CHANGELOG.md b/charts/partners/hashicorp/vault/0.31.0/src/CHANGELOG.md
new file mode 100644
index 000000000..379c9cf26
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/CHANGELOG.md
@@ -0,0 +1,635 @@
+## Unreleased
+
+## 0.31.0 (September 25, 2025)
+
+Changes:
+
+* Default `vault` version updated to 1.20.4
+* Default `vault-csi-provider` version updated to 1.6.0
+* Change default `csi.daemonSet.providersDir` to "/var/run/secrets-store-csi-providers"
+
+Features:
+
+* csi: Add Red Hat certified vault-csi-provider image to OpenShift defaults [GH-1134](https://github.com/hashicorp/vault-helm/pull/1134)
+
+Improvements:
+
+* server: Add metricRelabelings to serviceMonitor options [GH-1131](https://github.com/hashicorp/vault-helm/pull/1131)
+
+## 0.30.1 (July 28, 2025)
+
+Changes:
+
+* Default `vault` version updated to 1.20.1
+* Default `vault-k8s` version updated to 1.7.0
+* Default `vault-csi-provider` version updated to 1.5.1
+* Tested with Kubernetes versions 1.29-1.33
+
+Bugs:
+
+* server: Allow `server.service.active.annotations` and `server.service.standby.annotation` to override `server.service.annotations` [GH-1121](https://github.com/hashicorp/vault-helm/pull/1121)
+
+## 0.30.0 (March 27, 2025)
+
+Changes:
+
+* Default `vault` version updated to 1.19.0
+* Default `vault-k8s` version updated to 1.6.2
+* Tested with Kubernetes versions 1.28-1.32
+
+Features:
+
+* server: Support setting custom preStop commands [GH-1099](https://github.com/hashicorp/vault-helm/pull/1099)
+
+Improvements:
+
+* server: Add pod labels to server-test.yaml [GH-1094](https://github.com/hashicorp/vault-helm/pull/1094)
+
+Bugs:
+
+* server: Fix invalid yaml in server test when volumeMounts or volumes are empty [GH-855](https://github.com/hashicorp/vault-helm/pull/855)
+* injector: Add RBAC for deleting configmaps [GH-1100](https://github.com/hashicorp/vault-helm/pull/1100)
+
+## 0.29.1 (November 20, 2024)
+
+Bugs:
+* server: restore support for templated config [GH-1073](https://github.com/hashicorp/vault-helm/pull/1073)
+
+## 0.29.0 (November 7, 2024)
+
+KNOWN ISSUES:
+* Template support in server config stopped working [GH-1072](https://github.com/hashicorp/vault-helm/issues/1072)
+
+Changes:
+
+* Default `vault` version updated to 1.18.1
+* Default `vault-k8s` version updated to 1.5.0
+* Default `vault-csi-provider` version updated to 1.5.0
+* Tested with Kubernetes versions 1.27-1.31
+
+Features:
+
+* csi: Allow modification of the hostNetwork parameter on the DaemonSet [GH-1046](https://github.com/hashicorp/vault-helm/pull/1046)
+
+Bugs:
+
+* Properly handle JSON formatted server config [GH-1049](https://github.com/hashicorp/vault-helm/pull/1049)
+
+## 0.28.1 (July 11, 2024)
+
+Changes:
+
+* Default `vault` version updated to 1.17.2
+* Default `vault-k8s` version updated to 1.4.2
+* Default `vault-csi-provider` version updated to 1.4.3
+* Tested with Kubernetes versions 1.26-1.30
+
+Improvements:
+
+* Configurable `tlsConfig` and `authorization` for Prometheus ServiceMonitor [GH-1025](https://github.com/hashicorp/vault-helm/pull/1025)
+* Remove UPDATE from injector-mutating-webhook [GH-783](https://github.com/hashicorp/vault-helm/pull/783)
+* Add scope to mutating webhook [GH-1037](https://github.com/hashicorp/vault-helm/pull/1037)
+
+## 0.28.0 (April 8, 2024)
+
+Changes:
+
+* Default `vault` version updated to 1.16.1
+* Default `vault-k8s` version updated to 1.4.1
+* Default `vault-csi-provider` version updated to 1.4.2
+* Tested with Kubernetes versions 1.25-1.29
+
+Features:
+
+* server: Add annotation on config change [GH-1001](https://github.com/hashicorp/vault-helm/pull/1001)
+
+Bugs:
+
+* injector: add missing `get` `nodes` permission to ClusterRole [GH-1005](https://github.com/hashicorp/vault-helm/pull/1005)
+
+## 0.27.0 (November 16, 2023)
+
+Changes:
+
+* Default `vault` version updated to 1.15.2
+
+Features:
+
+* server: Support setting `persistentVolumeClaimRetentionPolicy` on the StatefulSet [GH-965](https://github.com/hashicorp/vault-helm/pull/965)
+* server: Support setting labels on PVCs [GH-969](https://github.com/hashicorp/vault-helm/pull/969)
+* server: Support setting ingress rules for networkPolicy [GH-877](https://github.com/hashicorp/vault-helm/pull/877)
+
+Improvements:
+
+* Support exec in the server liveness probe [GH-971](https://github.com/hashicorp/vault-helm/pull/971)
+
+## 0.26.1 (October 30, 2023)
+
+Bugs:
+* Fix templating of `server.ha.replicas` when set via override file. The `0.26.0` chart would ignore `server.ha.replicas` and always deploy 3 server replicas when `server.ha.enabled=true` unless overridden by command line when issuing the helm command: `--set server.ha.replicas=<some_number>`. Fixed in [GH-961](https://github.com/hashicorp/vault-helm/pull/961)
+
+## 0.26.0 (October 27, 2023)
+
+Changes:
+* Default `vault` version updated to 1.15.1
+* Default `vault-k8s` version updated to 1.3.1
+* Default `vault-csi-provider` version updated to 1.4.1
+* Tested with Kubernetes versions 1.24-1.28
+* server: OpenShift default readiness probe returns 204 when uninitialized [GH-966](https://github.com/hashicorp/vault-helm/pull/966)
+
+Features:
+* server: Add support for dual stack clusters [GH-833](https://github.com/hashicorp/vault-helm/pull/833)
+* server: Support `hostAliases` for the StatefulSet pods [GH-955](https://github.com/hashicorp/vault-helm/pull/955)
+* server: Add `server.service.active.annotations` and `server.service.standby.annotations` [GH-896](https://github.com/hashicorp/vault-helm/pull/896)
+* server: Add long-lived service account token option [GH-923](https://github.com/hashicorp/vault-helm/pull/923)
+
+Bugs:
+* csi: Add namespace field to `csi-role` and `csi-rolebindings`. [GH-909](https://github.com/hashicorp/vault-helm/pull/909)
+
+Improvements:
+* global: Add `global.namespace` to override the helm installation namespace. [GH-909](https://github.com/hashicorp/vault-helm/pull/909)
+* server: use vault.fullname in Helm test [GH-912](https://github.com/hashicorp/vault-helm/pull/912)
+* server: Allow scaling HA replicas to zero [GH-943](https://github.com/hashicorp/vault-helm/pull/943)
+
+## 0.25.0 (June 26, 2023)
+
+Changes:
+* Latest Kubernetes version tested is now 1.27
+* server: Headless service ignores `server.service.publishNotReadyAddresses` setting and always sets it as `true` [GH-902](https://github.com/hashicorp/vault-helm/pull/902)
+* `vault` updated to 1.14.0 [GH-916](https://github.com/hashicorp/vault-helm/pull/916)
+* `vault-csi-provider` updated to 1.4.0 [GH-916](https://github.com/hashicorp/vault-helm/pull/916)
+
+Improvements:
+* CSI: Make `nodeSelector` and `affinity` configurable for CSI daemonset's pods [GH-862](https://github.com/hashicorp/vault-helm/pull/862)
+* injector: Add `ephemeralLimit` and `ephemeralRequest` as options for configuring Agent's ephemeral storage resources [GH-798](https://github.com/hashicorp/vault-helm/pull/798)
+* Minimum kubernetes version for chart reverted to 1.20.0 to allow installation on clusters older than the oldest tested version [GH-916](https://github.com/hashicorp/vault-helm/pull/916)
+
+Bugs:
+* server: Set the default for `prometheusRules.rules` to an empty list [GH-886](https://github.com/hashicorp/vault-helm/pull/886)
+
+## 0.24.1 (April 17, 2023)
+
+Bugs:
+* csi: Add RBAC required by v1.3.0 to create secret for HMAC key used to generate secret versions [GH-872](https://github.com/hashicorp/vault-helm/pull/872)
+
+## 0.24.0 (April 6, 2023)
+
+Changes:
+* Earliest Kubernetes version tested is now 1.22
+* `vault` updated to 1.13.1 [GH-863](https://github.com/hashicorp/vault-helm/pull/863)
+* `vault-k8s` updated to 1.2.1 [GH-868](https://github.com/hashicorp/vault-helm/pull/868)
+* `vault-csi-provider` updated to 1.3.0 [GH-749](https://github.com/hashicorp/vault-helm/pull/749)
+
+Features:
+* server: New `extraPorts` option for adding ports to the Vault server statefulset [GH-841](https://github.com/hashicorp/vault-helm/pull/841)
+* server: Add configurable Port Number in readinessProbe and livenessProbe for the server-statefulset [GH-831](https://github.com/hashicorp/vault-helm/pull/831)
+* injector: Make livenessProbe and readinessProbe configurable and add configurable startupProbe [GH-852](https://github.com/hashicorp/vault-helm/pull/852)
+* csi: Add an Agent sidecar to Vault CSI Provider pods to provide lease caching and renewals [GH-749](https://github.com/hashicorp/vault-helm/pull/749)
+
+## 0.23.0 (November 28th, 2022)
+
+Changes:
+* `vault` updated to 1.12.1 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+* `vault-k8s` updated to 1.1.0 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+* `vault-csi-provider` updated to 1.2.1 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+
+Features:
+* server: Add `extraLabels` for Vault server serviceAccount [GH-806](https://github.com/hashicorp/vault-helm/pull/806)
+* server: Add `server.service.active.enabled` and `server.service.standby.enabled` options to selectively disable additional services [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
+* server: Add `server.serviceAccount.serviceDiscovery.enabled` option to selectively disable a Vault service discovery role and role binding [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
+* server: Add `server.service.instanceSelector.enabled` option to allow selecting pods outside the helm chart deployment [GH-813](https://github.com/hashicorp/vault-helm/pull/813)
+
+Bugs:
+* server: Quote `.server.ha.clusterAddr` value [GH-810](https://github.com/hashicorp/vault-helm/pull/810)
+
+## 0.22.1 (October 26th, 2022)
+
+Changes:
+* `vault` updated to 1.12.0 [GH-803](https://github.com/hashicorp/vault-helm/pull/803)
+* `vault-k8s` updated to 1.0.1 [GH-803](https://github.com/hashicorp/vault-helm/pull/803)
+
+## 0.22.0 (September 8th, 2022)
+
+Features:
+* Add PrometheusOperator support for collecting Vault server metrics. [GH-772](https://github.com/hashicorp/vault-helm/pull/772)
+
+Changes:
+* `vault-k8s` to 1.0.0 [GH-784](https://github.com/hashicorp/vault-helm/pull/784)
+* Test against Kubernetes 1.25 [GH-784](https://github.com/hashicorp/vault-helm/pull/784)
+* `vault` updated to 1.11.3 [GH-785](https://github.com/hashicorp/vault-helm/pull/785)
+
+## 0.21.0 (August 10th, 2022)
+
+CHANGES:
+* `vault-k8s` updated to 0.17.0. [GH-771](https://github.com/hashicorp/vault-helm/pull/771)
+* `vault-csi-provider` updated to 1.2.0 [GH-771](https://github.com/hashicorp/vault-helm/pull/771)
+* `vault` updated to 1.11.2 [GH-771](https://github.com/hashicorp/vault-helm/pull/771)
+* Start testing against Kubernetes 1.24. [GH-744](https://github.com/hashicorp/vault-helm/pull/744)
+* Deprecated `injector.externalVaultAddr`. Added `global.externalVaultAddr`, which applies to both the Injector and the CSI Provider. [GH-745](https://github.com/hashicorp/vault-helm/pull/745)
+* CSI Provider pods now set the `VAULT_ADDR` environment variable to either the internal Vault service or the configured external address. [GH-745](https://github.com/hashicorp/vault-helm/pull/745)
+
+Features:
+* server: Add `server.statefulSet.securityContext` to override pod and container `securityContext`. [GH-767](https://github.com/hashicorp/vault-helm/pull/767)
+* csi: Add `csi.daemonSet.securityContext` to override pod and container `securityContext`. [GH-767](https://github.com/hashicorp/vault-helm/pull/767)
+* injector: Add `injector.securityContext` to override pod and container `securityContext`. [GH-750](https://github.com/hashicorp/vault-helm/pull/750) and [GH-767](https://github.com/hashicorp/vault-helm/pull/767)
+* Add `server.service.activeNodePort` and `server.service.standbyNodePort` to specify the `nodePort` for active and standby services. [GH-610](https://github.com/hashicorp/vault-helm/pull/610)
+* Support for setting annotations on the injector's serviceAccount [GH-753](https://github.com/hashicorp/vault-helm/pull/753)
+
+## 0.20.1 (May 25th, 2022)
+CHANGES:
+* `vault-k8s` updated to 0.16.1 [GH-739](https://github.com/hashicorp/vault-helm/pull/739)
+
+Improvements:
+* Mutating webhook will no longer target the agent injector pod [GH-736](https://github.com/hashicorp/vault-helm/pull/736)
+
+Bugs:
+* `vault` service account is now created even if the server is set to disabled, as per before 0.20.0 [GH-737](https://github.com/hashicorp/vault-helm/pull/737)
+
+## 0.20.0 (May 16th, 2022)
+
+CHANGES:
+* `global.enabled` now works as documented, that is, setting `global.enabled` to false will disable everything, with individual components able to be turned on individually [GH-703](https://github.com/hashicorp/vault-helm/pull/703)
+* Default value of `-` used for injector and server to indicate that they follow `global.enabled`. [GH-703](https://github.com/hashicorp/vault-helm/pull/703)
+* Vault default image to 1.10.3
+* CSI provider default image to 1.1.0
+* Vault K8s default image to 0.16.0
+* Earliest Kubernetes version tested is now 1.16
+* Helm 3.6+ now required
+
+Features:
+* Support topologySpreadConstraints in server and injector. [GH-652](https://github.com/hashicorp/vault-helm/pull/652)
+
+Improvements:
+* CSI: Set `extraLabels` for daemonset, pods, and service account [GH-690](https://github.com/hashicorp/vault-helm/pull/690)
+* Add namespace to injector-leader-elector role, rolebinding and secret [GH-683](https://github.com/hashicorp/vault-helm/pull/683)
+* Support policy/v1 PodDisruptionBudget in Kubernetes 1.21+ for server and injector [GH-710](https://github.com/hashicorp/vault-helm/pull/710)
+* Make the Cluster Address (CLUSTER_ADDR) configurable [GH-629](https://github.com/hashicorp/vault-helm/pull/709)
+* server: Make `publishNotReadyAddresses` configurable for services [GH-694](https://github.com/hashicorp/vault-helm/pull/694)
+* server: Allow config to be defined as a YAML object in the values file [GH-684](https://github.com/hashicorp/vault-helm/pull/684)
+* Maintain default MutatingWebhookConfiguration values from `v1beta1` [GH-692](https://github.com/hashicorp/vault-helm/pull/692)
+
+## 0.19.0 (January 20th, 2022)
+
+CHANGES:
+* Vault image default 1.9.2
+* Vault K8s image default 0.14.2
+
+Features:
+* Added configurable podDisruptionBudget for injector [GH-653](https://github.com/hashicorp/vault-helm/pull/653)
+* Make terminationGracePeriodSeconds configurable for server [GH-659](https://github.com/hashicorp/vault-helm/pull/659)
+* Added configurable update strategy for injector [GH-661](https://github.com/hashicorp/vault-helm/pull/661)
+* csi: ability to set priorityClassName for CSI daemonset pods [GH-670](https://github.com/hashicorp/vault-helm/pull/670)
+
+Improvements:
+* Set the namespace on the OpenShift Route [GH-679](https://github.com/hashicorp/vault-helm/pull/679)
+* Add volumes and env vars to helm hook test pod [GH-673](https://github.com/hashicorp/vault-helm/pull/673)
+* Make TLS configurable for OpenShift routes [GH-686](https://github.com/hashicorp/vault-helm/pull/686)
+
+## 0.18.0 (November 17th, 2021)
+
+CHANGES:
+* Removed support for deploying a leader-elector container with the [vault-k8s injector](https://github.com/hashicorp/vault-k8s) injector since vault-k8s now uses an internal mechanism to determine leadership [GH-649](https://github.com/hashicorp/vault-helm/pull/649)
+* Vault image default 1.9.0
+* Vault K8s image default 0.14.1
+
+Improvements:
+* Added templateConfig.staticSecretRenderInterval chart option for the injector [GH-621](https://github.com/hashicorp/vault-helm/pull/621)
+
+## 0.17.1 (October 25th, 2021)
+
+Improvements:
+  * Add option for Ingress PathType [GH-634](https://github.com/hashicorp/vault-helm/pull/634)
+
+## 0.17.0 (October 21st, 2021)
+
+KNOWN ISSUES:
+* The chart will fail to deploy on Kubernetes 1.19+ with `server.ingress.enabled=true` because no `pathType` is set
+
+CHANGES:
+* Vault image default 1.8.4
+* Vault K8s image default 0.14.0
+
+Improvements:
+* Support Ingress stable networking API [GH-590](https://github.com/hashicorp/vault-helm/pull/590)
+* Support setting the `externalTrafficPolicy` for `LoadBalancer` and `NodePort` service types [GH-626](https://github.com/hashicorp/vault-helm/pull/626)
+* Support setting ingressClassName on server Ingress [GH-630](https://github.com/hashicorp/vault-helm/pull/630)
+
+Bugs:
+* Ensure `kubeletRootDir` volume path and mounts are the same when `csi.daemonSet.kubeletRootDir` is overridden [GH-628](https://github.com/hashicorp/vault-helm/pull/628)
+
+## 0.16.1 (September 29th, 2021)
+
+CHANGES:
+* Vault image default 1.8.3
+* Vault K8s image default 0.13.1
+
+## 0.16.0 (September 16th, 2021)
+
+CHANGES:
+* Support for deploying a leader-elector container with the [vault-k8s injector](https://github.com/hashicorp/vault-k8s) injector will be removed in version 0.18.0 of this chart since vault-k8s now uses an internal mechanism to determine leadership. To enable the deployment of the leader-elector container for use with vault-k8s 0.12.0 and earlier, set `useContainer=true`.
+
+Improvements:
+ * Make CSI provider `hostPaths` configurable via `csi.daemonSet.providersDir` and `csi.daemonSet.kubeletRootDir` [GH-603](https://github.com/hashicorp/vault-helm/pull/603)
+ * Support vault-k8s internal leader election [GH-568](https://github.com/hashicorp/vault-helm/pull/568) [GH-607](https://github.com/hashicorp/vault-helm/pull/607)
+
+## 0.15.0 (August 23rd, 2021)
+
+Improvements:
+* Add imagePullSecrets on server test [GH-572](https://github.com/hashicorp/vault-helm/pull/572)
+* Add injector.webhookAnnotations chart option [GH-584](https://github.com/hashicorp/vault-helm/pull/584)
+
+## 0.14.0 (July 28th, 2021)
+
+Features:
+* Added templateConfig.exitOnRetryFailure chart option for the injector [GH-560](https://github.com/hashicorp/vault-helm/pull/560)
+
+Improvements:
+* Support configuring pod tolerations, pod affinity, and node selectors as YAML [GH-565](https://github.com/hashicorp/vault-helm/pull/565)
+* Set the default vault image to come from the hashicorp organization [GH-567](https://github.com/hashicorp/vault-helm/pull/567)
+* Add support for running the acceptance tests against a local `kind` cluster [GH-567](https://github.com/hashicorp/vault-helm/pull/567)
+* Add `server.ingress.activeService` to configure if the ingress should use the active service [GH-570](https://github.com/hashicorp/vault-helm/pull/570)
+* Add `server.route.activeService` to configure if the route should use the active service [GH-570](https://github.com/hashicorp/vault-helm/pull/570)
+* Support configuring `global.imagePullSecrets` from a string array [GH-576](https://github.com/hashicorp/vault-helm/pull/576)
+
+
+## 0.13.0 (June 17th, 2021)
+
+Improvements:
+* Added a helm test for vault server [GH-531](https://github.com/hashicorp/vault-helm/pull/531)
+* Added server.enterpriseLicense option [GH-547](https://github.com/hashicorp/vault-helm/pull/547)
+* Added OpenShift overrides [GH-549](https://github.com/hashicorp/vault-helm/pull/549)
+
+Bugs:
+* Fix ui.serviceNodePort schema [GH-537](https://github.com/hashicorp/vault-helm/pull/537)
+* Fix server.ha.disruptionBudget.maxUnavailable schema [GH-535](https://github.com/hashicorp/vault-helm/pull/535)
+* Added webhook-certs volume mount to sidecar injector [GH-545](https://github.com/hashicorp/vault-helm/pull/545)
+
+## 0.12.0 (May 25th, 2021)
+
+Features:
+* Pass additional arguments to `vault-csi-provider` using `csi.extraArgs` [GH-526](https://github.com/hashicorp/vault-helm/pull/526)
+
+Improvements:
+* Set chart kubeVersion and added chart-verifier tests [GH-510](https://github.com/hashicorp/vault-helm/pull/510)
+* Added values json schema [GH-513](https://github.com/hashicorp/vault-helm/pull/513)
+* Ability to set tolerations for CSI daemonset pods [GH-521](https://github.com/hashicorp/vault-helm/pull/521)
+* UI target port is now configurable [GH-437](https://github.com/hashicorp/vault-helm/pull/437)
+
+Bugs:
+* CSI: `global.imagePullSecrets` are now also used for CSI daemonset [GH-519](https://github.com/hashicorp/vault-helm/pull/519)
+
+## 0.11.0 (April 14th, 2021)
+
+Features:
+* Added `server.enabled` to explicitly skip installing a Vault server [GH-486](https://github.com/hashicorp/vault-helm/pull/486)
+* Injector now supports enabling host network [GH-471](https://github.com/hashicorp/vault-helm/pull/471)
+* Injector port is now configurable [GH-489](https://github.com/hashicorp/vault-helm/pull/489)
+* Injector Vault Agent resource defaults are now configurable [GH-493](https://github.com/hashicorp/vault-helm/pull/493)
+* Extra paths can now be added to the Vault ingress service [GH-460](https://github.com/hashicorp/vault-helm/pull/460)
+* Log level and format can now be set directly using `server.logFormat` and `server.logLevel` [GH-488](https://github.com/hashicorp/vault-helm/pull/488)
+
+Improvements:
+* Added `https` name to injector service port [GH-495](https://github.com/hashicorp/vault-helm/pull/495)
+
+Bugs:
+* CSI: Fix ClusterRole name and DaemonSet's service account to properly match deployment name [GH-486](https://github.com/hashicorp/vault-helm/pull/486)
+
+## 0.10.0 (March 25th, 2021)
+
+Features:
+* Add support for [Vault CSI provider](https://github.com/hashicorp/vault-csi-provider) [GH-461](https://github.com/hashicorp/vault-helm/pull/461)
+
+Improvements:
+* `objectSelector` can now be set on the mutating admission webhook [GH-456](https://github.com/hashicorp/vault-helm/pull/456)
+
+## 0.9.1 (February 2nd, 2021)
+
+Bugs:
+* Injector: fix labels for default anti-affinity rule [GH-441](https://github.com/hashicorp/vault-helm/pull/441), [GH-442](https://github.com/hashicorp/vault-helm/pull/442)
+* Set VAULT_DEV_LISTEN_ADDRESS in dev mode [GH-446](https://github.com/hashicorp/vault-helm/pull/446)
+
+## 0.9.0 (January 5th, 2021)
+
+Features:
+* Injector now supports configurable number of replicas [GH-436](https://github.com/hashicorp/vault-helm/pull/436)
+* Injector now supports auto TLS for multiple replicas using leader elections [GH-436](https://github.com/hashicorp/vault-helm/pull/436)
+
+Improvements:
+* Dev mode now supports `server.extraArgs` [GH-421](https://github.com/hashicorp/vault-helm/pull/421)
+* Dev mode root token is now configurable with `server.dev.devRootToken` [GH-415](https://github.com/hashicorp/vault-helm/pull/415)
+* ClusterRoleBinding updated to `v1` [GH-395](https://github.com/hashicorp/vault-helm/pull/395)
+* MutatingWebhook updated to `v1` [GH-408](https://github.com/hashicorp/vault-helm/pull/408)
+* Injector service now supports `injector.service.annotations` [425](https://github.com/hashicorp/vault-helm/pull/425)
+* Injector now supports `injector.extraLabels` [428](https://github.com/hashicorp/vault-helm/pull/428)
+* Added `allowPrivilegeEscalation: false` to Vault and Injector containers [429](https://github.com/hashicorp/vault-helm/pull/429)
+* Network Policy now supports `server.networkPolicy.egress` [389](https://github.com/hashicorp/vault-helm/pull/389)
+
+## 0.8.0 (October 20th, 2020)
+
+Improvements:
+* Make server NetworkPolicy independent of OpenShift [GH-381](https://github.com/hashicorp/vault-helm/pull/381)
+* Added configurables for all probe values [GH-387](https://github.com/hashicorp/vault-helm/pull/387)
+* MountPath for audit and data storage is now configurable [GH-393](https://github.com/hashicorp/vault-helm/pull/393)
+* Annotations can now be added to the Injector pods [GH-394](https://github.com/hashicorp/vault-helm/pull/394)
+* The injector can now be configured with a failurePolicy [GH-400](https://github.com/hashicorp/vault-helm/pull/400)
+* Added additional environment variables for rendering within Vault config [GH-398](https://github.com/hashicorp/vault-helm/pull/398)
+* Service account for Vault K8s auth is automatically created when `injector.externalVaultAddr` is set [GH-392](https://github.com/hashicorp/vault-helm/pull/392)
+
+Bugs:
+* Fixed install output using Helm V2 command [GH-378](https://github.com/hashicorp/vault-helm/pull/378)
+
+## 0.7.0 (August 24th, 2020)
+
+Features:
+* Added `volumes` and `volumeMounts` for mounting _any_ type of volume [GH-314](https://github.com/hashicorp/vault-helm/pull/314).
+* Added configurable to enable prometheus telemetery exporter for Vault Agent Injector [GH-372](https://github.com/hashicorp/vault-helm/pull/372)
+
+Improvements:
+* Added `defaultMode` configurable to `extraVolumes`[GH-321](https://github.com/hashicorp/vault-helm/pull/321)
+* Option to install and use PodSecurityPolicy's for vault server and injector [GH-177](https://github.com/hashicorp/vault-helm/pull/177)
+* `VAULT_API_ADDR` is now configurable [GH-290](https://github.com/hashicorp/vault-helm/pull/290)
+* Removed deprecated tolerate unready endpoint annotations [GH-363](https://github.com/hashicorp/vault-helm/pull/363)
+* Add an option to set annotations on the StatefulSet [GH-199](https://github.com/hashicorp/vault-helm/pull/199)
+* Make the vault server serviceAccount name a configuration option [GH-367](https://github.com/hashicorp/vault-helm/pull/367)
+* Removed annotation striction from `dev` mode [GH-371](https://github.com/hashicorp/vault-helm/pull/371)
+* Add an option to set annotations on PVCs [GH-364](https://github.com/hashicorp/vault-helm/pull/364)
+* Added service configurables for UI [GH-285](https://github.com/hashicorp/vault-helm/pull/285)
+
+Bugs:
+* Fix python dependency in test image [GH-337](https://github.com/hashicorp/vault-helm/pull/337)
+* Fix caBundle not being quoted causing validation issues with Helm 3 [GH-352](https://github.com/hashicorp/vault-helm/pull/352)
+* Fix injector network policy being rendered when injector is not enabled [GH-358](https://github.com/hashicorp/vault-helm/pull/358)
+
+## 0.6.0 (June 3rd, 2020)
+
+Features:
+* Added `extraInitContainers` to define init containers for the Vault cluster [GH-258](https://github.com/hashicorp/vault-helm/pull/258)
+* Added `postStart` lifecycle hook allowing users to configure commands to run on the Vault pods after they're ready [GH-315](https://github.com/hashicorp/vault-helm/pull/315)
+* Beta: Added OpenShift support [GH-319](https://github.com/hashicorp/vault-helm/pull/319)
+
+Improvements:
+* Server configs can now be defined in YAML.  Multi-line string configs are still compatible [GH-213](https://github.com/hashicorp/vault-helm/pull/213)
+* Removed IPC_LOCK privileges since swap is disabled on containers [[GH-198](https://github.com/hashicorp/vault-helm/pull/198)]
+* Use port names that map to vault.scheme [[GH-223](https://github.com/hashicorp/vault-helm/pull/223)]
+* Allow both yaml and multi-line string annotations [[GH-272](https://github.com/hashicorp/vault-helm/pull/272)]
+* Added configurable to set the Raft node name to hostname [[GH-269](https://github.com/hashicorp/vault-helm/pull/269)]
+* Support setting priorityClassName on pods [[GH-282](https://github.com/hashicorp/vault-helm/pull/282)]
+* Added support for ingress apiVersion `networking.k8s.io/v1beta1` [[GH-310](https://github.com/hashicorp/vault-helm/pull/310)]
+* Added configurable to change service type for the HA active service [GH-317](https://github.com/hashicorp/vault-helm/pull/317)
+
+Bugs:
+* Fixed default ingress path [[GH-224](https://github.com/hashicorp/vault-helm/pull/224)]
+* Fixed annotations for HA standby/active services [[GH-268](https://github.com/hashicorp/vault-helm/pull/268)]
+* Updated some value defaults to match their use in templates [[GH-309](https://github.com/hashicorp/vault-helm/pull/309)]
+* Use active service on ingress when ha [[GH-270](https://github.com/hashicorp/vault-helm/pull/270)]
+* Fixed bug where pull secrets weren't being used for injector image [GH-298](https://github.com/hashicorp/vault-helm/pull/298)
+
+## 0.5.0 (April 9th, 2020)
+
+Features:
+
+* Added Raft support for HA mode [[GH-228](https://github.com/hashicorp/vault-helm/pull/229)]
+* Now supports Vault Enterprise [[GH-250](https://github.com/hashicorp/vault-helm/pull/250)]
+* Added K8s Service Registration for HA modes [[GH-250](https://github.com/hashicorp/vault-helm/pull/250)]
+
+* Option to set `AGENT_INJECT_VAULT_AUTH_PATH` for the injector [[GH-185](https://github.com/hashicorp/vault-helm/pull/185)]
+* Added environment variables for logging and revocation on Vault Agent Injector [[GH-219](https://github.com/hashicorp/vault-helm/pull/219)]
+* Option to set environment variables for the injector deployment [[GH-232](https://github.com/hashicorp/vault-helm/pull/232)]
+* Added affinity, tolerations, and nodeSelector options for the injector deployment [[GH-234](https://github.com/hashicorp/vault-helm/pull/234)]
+* Made all annotations multi-line strings [[GH-227](https://github.com/hashicorp/vault-helm/pull/227)]
+
+## 0.4.0 (February 21st, 2020)
+
+Improvements:
+
+* Allow process namespace sharing between Vault and sidecar containers [[GH-174](https://github.com/hashicorp/vault-helm/pull/174)]
+* Added configurable to change updateStrategy [[GH-172](https://github.com/hashicorp/vault-helm/pull/172)]
+* Added sleep in the preStop lifecycle step [[GH-188](https://github.com/hashicorp/vault-helm/pull/188)]
+* Updated chart and tests to Helm 3 [[GH-195](https://github.com/hashicorp/vault-helm/pull/195)]
+* Adds Values.injector.externalVaultAddr to use the injector with an external vault [[GH-207](https://github.com/hashicorp/vault-helm/pull/207)]
+
+Bugs:
+
+* Fix bug where Vault lifecycle was appended after extra containers. [[GH-179](https://github.com/hashicorp/vault-helm/pull/179)]
+
+## 0.3.3 (January 14th, 2020)
+
+Security:
+
+* Added `server.extraArgs` to allow loading of additional Vault configurations containing sensitive settings [GH-175](https://github.com/hashicorp/vault-helm/issues/175)
+
+Bugs:
+
+* Fixed injection bug where wrong environment variables were being used for manually mounted TLS files
+
+## 0.3.2 (January 8th, 2020)
+
+Bugs:
+
+* Fixed injection bug where TLS Skip Verify was true by default [VK8S-35]
+
+## 0.3.1 (January 2nd, 2020)
+
+Bugs:
+
+* Fixed injection bug causing kube-system pods to be rejected [VK8S-14]
+
+## 0.3.0 (December 19th, 2019)
+
+Features:
+
+* Extra containers can now be added to the Vault pods
+* Added configurability of pod probes
+* Added Vault Agent Injector
+
+Improvements:
+
+* Moved `global.image` to `server.image`
+* Changed UI service template to route pods that aren't ready via `publishNotReadyAddresses: true`
+* Added better HTTP/HTTPS scheme support to http probes
+* Added configurable node port for Vault service
+* `server.authDelegator` is now enabled by default
+
+Bugs:
+
+* Fixed upgrade bug by removing chart label which contained the version
+* Fixed typo on `serviceAccount` (was `serviceaccount`)
+* Fixed readiness/liveliness HTTP probe default to accept standbys
+
+## 0.2.1 (November 12th, 2019)
+
+Bugs:
+
+* Removed `readOnlyRootFilesystem` causing issues when validating deployments
+
+## 0.2.0 (October 29th, 2019)
+
+Features:
+
+* Added load balancer support
+* Added ingress support
+* Added configurable for service types (ClusterIP, NodePort, LoadBalancer, etc)
+* Removed root requirements, now runs as Vault user
+
+Improvements:
+
+* Added namespace value to all rendered objects
+* Made ports configurable in services
+* Added the ability to add custom annotations to services
+* Added docker image for running bats test in CircleCI
+* Removed restrictions around `dev` mode such as annotations
+* `readOnlyRootFilesystem` is now configurable
+* Image Pull Policy is now configurable
+
+Bugs:
+
+* Fixed selector bugs related to Helm label updates (services, affinities, and pod disruption)
+* Fixed bug where audit storage was not being mounted in HA mode
+* Fixed bug where Vault pod wasn't receiving SIGTERM signals
+
+
+## 0.1.2 (August 22nd, 2019)
+
+Features:
+
+* Added `extraSecretEnvironmentVars` to allow users to mount secrets as
+  environment variables
+* Added `tlsDisable` configurable to change HTTP protocols from HTTP/HTTPS
+  depending on the value
+* Added `serviceNodePort` to configure a NodePort value when setting `serviceType`
+  to "NodePort"
+
+Improvements:
+
+* Changed UI port to 8200 for better HTTP protocol support
+* Added `path` to `extraVolumes` to define where the volume should be
+  mounted.  Defaults to `/vault/userconfig`
+* Upgraded Vault to 1.2.2
+
+Bugs:
+
+* Fixed bug where upgrade would fail because immutable labels were being
+  changed (Helm Version label)
+* Fixed bug where UI service used wrong selector after updating helm labels
+* Added `VAULT_API_ADDR` env to Vault pod to fixed bug where Vault thinks
+  Consul is the active node
+* Removed `step-down` preStop since it requires authentication.  Shutdown signal
+  sent by Kube acts similar to `step-down`
+
+
+## 0.1.1 (August 7th, 2019)
+
+Features:
+
+* Added `authDelegator` Cluster Role Binding to Vault service account for
+  bootstrapping Kube auth method
+
+Improvements:
+
+* Added `server.service.clusterIP` to `values.yml` so users can toggle
+  the Vault service to headless by using the value `None`.
+* Upgraded Vault to 1.2.1
+
+## 0.1.0 (August 6th, 2019)
+
+Initial release
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/CODEOWNERS b/charts/partners/hashicorp/vault/0.31.0/src/CODEOWNERS
new file mode 100644
index 000000000..a765f7ea9
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/CODEOWNERS
@@ -0,0 +1 @@
+* @hashicorp/vault-ecosystem
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/CONTRIBUTING.md b/charts/partners/hashicorp/vault/0.31.0/src/CONTRIBUTING.md
new file mode 100644
index 000000000..ad31ac92d
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/CONTRIBUTING.md
@@ -0,0 +1,247 @@
+# Contributing to Vault Helm
+
+**Please note:** We take Vault's security and our users' trust very seriously.
+If you believe you have found a security issue in Vault, please responsibly
+disclose by contacting us at security@hashicorp.com.
+
+**First:** if you're unsure or afraid of _anything_, just ask or submit the
+issue or pull request anyways. You won't be yelled at for giving it your best
+effort. The worst that can happen is that you'll be politely asked to change
+something. We appreciate any sort of contributions, and don't want a wall of
+rules to get in the way of that.
+
+That said, if you want to ensure that a pull request is likely to be merged,
+talk to us! You can find out our thoughts and ensure that your contribution
+won't clash or be obviated by Vault's normal direction. A great way to do this
+is via the [Vault Discussion Forum][1].
+
+This document will cover what we're looking for in terms of reporting issues.
+By addressing all the points we're looking for, it raises the chances we can
+quickly merge or address your contributions.
+
+[1]: https://discuss.hashicorp.com/c/vault
+
+## Issues
+
+### Reporting an Issue
+
+* Make sure you test against the latest released version. It is possible
+  we already fixed the bug you're experiencing. Even better is if you can test
+  against `main`, as bugs are fixed regularly but new versions are only
+  released every few months.
+
+* Provide steps to reproduce the issue, and if possible include the expected
+  results as well as the actual results. Please provide text, not screen shots!
+
+* Respond as promptly as possible to any questions made by the Vault
+  team to your issue. Stale issues will be closed periodically.
+
+### Issue Lifecycle
+
+1. The issue is reported.
+
+2. The issue is verified and categorized by a Vault Helm collaborator.
+   Categorization is done via tags. For example, bugs are marked as "bugs".
+
+3. Unless it is critical, the issue may be left for a period of time (sometimes
+   many weeks), giving outside contributors -- maybe you!? -- a chance to
+   address the issue.
+
+4. The issue is addressed in a pull request or commit. The issue will be
+   referenced in the commit message so that the code that fixes it is clearly
+   linked.
+
+5. The issue is closed. Sometimes, valid issues will be closed to keep
+   the issue tracker clean. The issue is still indexed and available for
+   future viewers, or can be re-opened if necessary.
+
+## Testing
+
+The Helm chart ships with both unit and acceptance tests.
+
+The unit tests don't require any active Kubernetes cluster and complete
+very quickly. These should be used for fast feedback during development.
+The acceptance tests require a Kubernetes cluster with a configured `kubectl`.
+
+### Test Using Docker Container
+
+The following are the instructions for running bats tests using a Docker container.
+
+#### Prerequisites
+
+* Docker installed
+* `vault-helm` checked out locally
+
+#### Test
+
+**Note:** the following commands should be run from the `vault-helm` directory.
+
+First, build the Docker image for running the tests:
+
+```shell
+docker build -f ${PWD}/test/docker/Test.dockerfile ${PWD}/test/docker/ -t vault-helm-test
+```
+Next, execute the tests with the following commands:
+```shell
+docker run -it --rm -v "${PWD}:/test" vault-helm-test bats /test/test/unit
+```
+It's possible to only run specific bats tests using regular expressions. 
+For example, the following will run only tests with "injector" in the name:
+```shell
+docker run -it --rm -v "${PWD}:/test" vault-helm-test bats /test/test/unit -f "injector"
+```
+
+### Test Manually
+The following are the instructions for running bats tests on your workstation.
+#### Prerequisites
+* [Bats](https://github.com/bats-core/bats-core)
+  ```bash
+  brew install bats-core
+  ```
+* [yq](https://pypi.org/project/yq/)
+  ```bash
+  brew install python-yq
+  ```
+* [helm](https://helm.sh)
+  ```bash
+  brew install kubernetes-helm
+  ```
+
+#### Test
+
+To run the unit tests:
+
+    bats ./test/unit
+
+To run the acceptance tests:
+
+    bats ./test/acceptance
+
+If the acceptance tests fail, deployed resources in the Kubernetes cluster
+may not be properly cleaned up. We recommend recycling the Kubernetes cluster to
+start from a clean slate.
+
+**Note:** There is a Terraform configuration in the
+[`test/terraform/`](https://github.com/hashicorp/vault-helm/tree/main/test/terraform) directory
+that can be used to quickly bring up a GKE cluster and configure
+`kubectl` and `helm` locally. This can be used to quickly spin up a test
+cluster for acceptance tests. Unit tests _do not_ require a running Kubernetes
+cluster.
+
+### Writing Unit Tests
+
+Changes to the Helm chart should be accompanied by appropriate unit tests.
+
+#### Formatting
+
+- Put tests in the test file in the same order as the variables appear in the `values.yaml`.
+- Start tests for a chart value with a header that says what is being tested, like this:
+    ```
+    #--------------------------------------------------------------------
+    # annotations
+    ```
+
+- Name the test based on what it's testing in the following format (this will be its first line):
+    ```
+    @test "<section being tested>: <short description of the test case>" {
+    ```
+
+    When adding tests to an existing file, the first section will be the same as the other tests in the file.
+
+#### Test Details
+
+[Bats](https://github.com/bats-core/bats-core) provides a way to run commands in a shell and inspect the output in an automated way.
+In all of the tests in this repo, the base command being run is [helm template](https://docs.helm.sh/helm/#helm-template) which turns the templated files into straight yaml output.
+In this way, we're able to test that the various conditionals in the templates render as we would expect.
+
+Each test defines the files that should be rendered using the `--show-only` flag, then it might adjust chart values by adding `--set` flags as well.
+The output from this `helm template` command is then piped to [yq](https://pypi.org/project/yq/).
+`yq` allows us to pull out just the information we're interested in, either by referencing its position in the yaml file directly or giving information about it (like its length).
+The `-r` flag can be used with `yq` to return a raw string instead of a quoted one which is especially useful when looking for an exact match.
+
+The test passes or fails based on the conditional at the end that is in square brackets, which is a comparison of our expected value and the output of  `helm template` piped to `yq`.
+
+The `| tee /dev/stderr ` pieces direct any terminal output of the `helm template` and `yq` commands to stderr so that it doesn't interfere with `bats`.
+
+#### Test Examples
+
+Here are some examples of common test patterns:
+
+- Check that a value is disabled by default
+
+    ```
+    @test "ui/Service: no type by default" {
+      cd `chart_dir`
+      local actual=$(helm template \
+          --show-only templates/ui-service.yaml  \
+          . | tee /dev/stderr |
+          yq -r '.spec.type' | tee /dev/stderr)
+      [ "${actual}" = "null" ]
+    }
+    ```
+
+    In this example, nothing is changed from the default templates (no `--set` flags), then we use `yq` to retrieve the value we're checking, `.spec.type`.
+    This output is then compared against our expected value (`null` in this case) in the assertion `[ "${actual}" = "null" ]`.
+
+
+- Check that a template value is rendered to a specific value
+    ```
+    @test "ui/Service: specified type" {
+      cd `chart_dir`
+      local actual=$(helm template \
+          --show-only templates/ui-service.yaml  \
+          --set 'ui.serviceType=LoadBalancer' \
+          . | tee /dev/stderr |
+          yq -r '.spec.type' | tee /dev/stderr)
+      [ "${actual}" = "LoadBalancer" ]
+    }
+    ```
+
+    This is very similar to the last example, except we've changed a default value with the `--set` flag and correspondingly changed the expected value.
+
+- Check that a template value contains several values
+    ```
+	@test "server/standalone-StatefulSet: custom resources" {
+	  cd `chart_dir`
+	  local actual=$(helm template \
+		  --show-only templates/server-statefulset.yaml  \
+		  --set 'server.standalone.enabled=true' \
+		  --set 'server.resources.requests.memory=256Mi' \
+		  --set 'server.resources.requests.cpu=250m' \
+		  . | tee /dev/stderr |
+		  yq -r '.spec.template.spec.containers[0].resources.requests.memory' | tee /dev/stderr)
+	  [ "${actual}" = "256Mi" ]
+
+	  local actual=$(helm template \
+		  --show-only templates/server-statefulset.yaml  \
+		  --set 'server.standalone.enabled=true' \
+		  --set 'server.resources.limits.memory=256Mi' \
+		  --set 'server.resources.limits.cpu=250m' \
+		  . | tee /dev/stderr |
+		  yq -r '.spec.template.spec.containers[0].resources.limits.memory' | tee /dev/stderr)
+	  [ "${actual}" = "256Mi" ]
+    ```
+
+    *Note:* If testing more than two conditions, it would be good to separate the `helm template` part of the command from the `yq` sections to reduce redundant work.
+
+- Check that an entire template file is not rendered
+    ```
+    @test "syncCatalog/Deployment: disabled by default" {
+      cd `chart_dir`
+      local actual=$( (helm template \
+          --show-only templates/server-statefulset.yaml  \
+          --set 'global.enabled=false' \
+          . || echo "---") | tee /dev/stderr |
+          yq 'length > 0' | tee /dev/stderr)
+      [ "${actual}" = "false" ]
+    }
+    ```
+    Here we are check the length of the command output to see if the anything is rendered.
+    This style can easily be switched to check that a file is rendered instead.
+
+## Contributor License Agreement
+
+We require that all contributors sign our Contributor License Agreement ("CLA")
+before we can accept the contribution.
+
+[Learn more about why HashiCorp requires a CLA and what the CLA includes](https://www.hashicorp.com/cla)
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/Chart.yaml b/charts/partners/hashicorp/vault/0.31.0/src/Chart.yaml
new file mode 100644
index 000000000..4e40009af
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/Chart.yaml
@@ -0,0 +1,23 @@
+annotations:
+  charts.openshift.io/name: HashiCorp Vault
+apiVersion: v2
+appVersion: 1.20.4
+description: Official HashiCorp Vault Chart
+home: https://www.vaultproject.io
+icon: https://github.com/hashicorp/vault/raw/f22d202cde2018f9455dec755118a9b84586e082/Vault_PrimaryLogo_Black.png
+keywords:
+- vault
+- security
+- encryption
+- secrets
+- management
+- automation
+- infrastructure
+kubeVersion: '>= 1.20.0-0'
+name: vault
+sources:
+- https://github.com/hashicorp/vault
+- https://github.com/hashicorp/vault-helm
+- https://github.com/hashicorp/vault-k8s
+- https://github.com/hashicorp/vault-csi-provider
+version: 0.31.0
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/LICENSE b/charts/partners/hashicorp/vault/0.31.0/src/LICENSE
new file mode 100644
index 000000000..74f38c010
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/LICENSE
@@ -0,0 +1,355 @@
+Copyright (c) 2018 HashiCorp, Inc.
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+     means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of version
+        1.1 or earlier of the License, but not also under the terms of a
+        Secondary License.
+
+1.6. “Executable Form”
+
+     means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+     means a work that combines Covered Software with other material, in a separate
+     file or files, that is not Covered Software.
+
+1.8. “License”
+
+     means this document.
+
+1.9. “Licensable”
+
+     means having the right to grant, to the maximum extent possible, whether at the
+     time of the initial grant or subsequently, any and all of the rights conveyed by
+     this License.
+
+1.10. “Modifications”
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to, deletion
+        from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+      means any patent claim(s), including without limitation, method, process,
+      and apparatus claims, in any patent Licensable by such Contributor that
+      would be infringed, but for the grant of the License, by the making,
+      using, selling, offering for sale, having made, import, or transfer of
+      either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+      means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, “You” includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, “control” means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or as
+        part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its Contributions
+        or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution become
+     effective for each Contribution on the date the Contributor first distributes
+     such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under this
+     License. No additional rights or licenses will be implied from the distribution
+     or licensing of Covered Software under this License. Notwithstanding Section
+     2.1(b) above, no patent license is granted by a Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party’s
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of its
+        Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or
+     logos of any Contributor (except as may be necessary to comply with the
+     notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this License
+     (see Section 10.2) or under the terms of a Secondary License (if permitted
+     under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its Contributions
+     are its original creation(s) or it has sufficient rights to grant the
+     rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under applicable
+     copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under the
+     terms of this License. You must inform recipients that the Source Code Form
+     of the Covered Software is governed by the terms of this License, and how
+     they can obtain a copy of this License. You may not attempt to alter or
+     restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this License,
+        or sublicense it under different terms, provided that the license for
+        the Executable Form does not attempt to limit or alter the recipients’
+        rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for the
+     Covered Software. If the Larger Work is a combination of Covered Software
+     with a work governed by one or more Secondary Licenses, and the Covered
+     Software is not Incompatible With Secondary Licenses, this License permits
+     You to additionally distribute such Covered Software under the terms of
+     such Secondary License(s), so that the recipient of the Larger Work may, at
+     their option, further distribute the Covered Software under the terms of
+     either this License or such Secondary License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices (including
+     copyright notices, patent notices, disclaimers of warranty, or limitations
+     of liability) contained within the Source Code Form of the Covered
+     Software, except that You may alter any license notices to the extent
+     required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on behalf
+     of any Contributor. You must make it absolutely clear that any such
+     warranty, support, indemnity, or liability obligation is offered by You
+     alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute, judicial
+   order, or regulation then You must: (a) comply with the terms of this License
+   to the maximum extent possible; and (b) describe the limitations and the code
+   they affect. Such description must be placed in a text file included with all
+   distributions of the Covered Software under this License. Except to the
+   extent prohibited by statute or regulation, such description must be
+   sufficiently detailed for a recipient of ordinary skill to be able to
+   understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+     if such Contributor fails to notify You of the non-compliance by some
+     reasonable means prior to 60 days after You have come back into compliance.
+     Moreover, Your grants from a particular Contributor are reinstated on an
+     ongoing basis if such Contributor notifies You of the non-compliance by
+     some reasonable means, this is the first time You have received notice of
+     non-compliance with this License from such Contributor, and You become
+     compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions, counter-claims,
+     and cross-claims) alleging that a Contributor Version directly or
+     indirectly infringes any patent, then the rights granted to You by any and
+     all Contributors for the Covered Software under Section 2.1 of this License
+     shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an “as is” basis, without
+   warranty of any kind, either expressed, implied, or statutory, including,
+   without limitation, warranties that the Covered Software is free of defects,
+   merchantable, fit for a particular purpose or non-infringing. The entire
+   risk as to the quality and performance of the Covered Software is with You.
+   Should any Covered Software prove defective in any respect, You (not any
+   Contributor) assume the cost of any necessary servicing, repair, or
+   correction. This disclaimer of warranty constitutes an essential part of this
+   License. No use of  any Covered Software is authorized under this License
+   except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from such
+   party’s negligence to the extent applicable law prohibits such limitation.
+   Some jurisdictions do not allow the exclusion or limitation of incidental or
+   consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts of
+   a jurisdiction where the defendant maintains its principal place of business
+   and such litigation shall be governed by laws of that jurisdiction, without
+   reference to its conflict-of-law provisions. Nothing in this Section shall
+   prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject matter
+   hereof. If any provision of this License is held to be unenforceable, such
+   provision shall be reformed only to the extent necessary to make it
+   enforceable. Any law or regulation which provides that the language of a
+   contract shall be construed against the drafter shall not be used to construe
+   this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version of
+      the License under which You originally received the Covered Software, or
+      under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a modified
+      version of this License if you rename the license and remove any
+      references to the name of the license steward (except to note that such
+      modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+      If You choose to distribute Source Code Form that is Incompatible With
+      Secondary Licenses under the terms of this version of the License, the
+      notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+      This Source Code Form is “Incompatible
+      With Secondary Licenses”, as defined by
+      the Mozilla Public License, v. 2.0.
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/Makefile b/charts/partners/hashicorp/vault/0.31.0/src/Makefile
new file mode 100644
index 000000000..97bf7bf90
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/Makefile
@@ -0,0 +1,101 @@
+TEST_IMAGE?=vault-helm-test
+GOOGLE_CREDENTIALS?=vault-helm-test.json
+CLOUDSDK_CORE_PROJECT?=vault-helm-dev-246514
+# set to run a single test - e.g acceptance/server-ha-enterprise-dr.bats
+ACCEPTANCE_TESTS?=acceptance
+
+# filter bats unit tests to run.
+UNIT_TESTS_FILTER?='.*'
+
+# set to 'true' to run acceptance tests locally in a kind cluster
+LOCAL_ACCEPTANCE_TESTS?=false
+
+# kind cluster name
+KIND_CLUSTER_NAME?=vault-helm
+
+# kind k8s version
+KIND_K8S_VERSION?=v1.32.3
+
+# Generate json schema for chart values. See test/README.md for more details.
+values-schema:
+	helm schema-gen values.yaml > values.schema.json
+
+test-image:
+	@docker build --rm -t $(TEST_IMAGE) -f $(CURDIR)/test/docker/Test.dockerfile $(CURDIR)
+
+test-unit:
+	@docker run --rm -it -v ${PWD}:/helm-test $(TEST_IMAGE) bats -f $(UNIT_TESTS_FILTER) /helm-test/test/unit
+
+test-bats: test-unit test-acceptance
+
+test: test-image test-bats
+
+# run acceptance tests on GKE
+# set google project/credential vars above
+test-acceptance:
+ifeq ($(LOCAL_ACCEPTANCE_TESTS),true)
+	make setup-kind acceptance
+else
+	@docker run -it -v ${PWD}:/helm-test \
+	-e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
+	-e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
+	-e KUBECONFIG=/helm-test/.kube/config \
+	-e VAULT_LICENSE_CI=${VAULT_LICENSE_CI} \
+	-w /helm-test \
+	$(TEST_IMAGE) \
+	make acceptance
+endif
+
+# destroy GKE cluster using terraform
+test-destroy:
+	@docker run -it -v ${PWD}:/helm-test \
+	-e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
+	-e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
+	-w /helm-test \
+	$(TEST_IMAGE) \
+	make destroy-cluster
+
+# provision GKE cluster using terraform
+test-provision:
+	@docker run -it -v ${PWD}:/helm-test \
+	-e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
+	-e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
+	-e KUBECONFIG=/helm-test/.kube/config \
+	-w /helm-test \
+	$(TEST_IMAGE) \
+	make provision-cluster
+
+# this target is for running the acceptance tests
+# it is run in the docker container above when the test-acceptance target is invoked
+acceptance:
+ifneq ($(LOCAL_ACCEPTANCE_TESTS),true)
+	gcloud auth activate-service-account --key-file=${GOOGLE_CREDENTIALS}
+endif
+	bats --tap --timing test/${ACCEPTANCE_TESTS}
+
+# this target is for provisioning the GKE cluster
+# it is run in the docker container above when the test-provision target is invoked
+provision-cluster:
+	gcloud auth activate-service-account --key-file=${GOOGLE_CREDENTIALS}
+	terraform init test/terraform
+	terraform apply -var project=${CLOUDSDK_CORE_PROJECT} -var init_cli=true -auto-approve test/terraform
+
+# this target is for removing the GKE cluster
+# it is run in the docker container above when the test-destroy target is invoked
+destroy-cluster:
+	terraform destroy -auto-approve
+
+# create a kind cluster for running the acceptance tests locally
+setup-kind:
+	kind get clusters | grep -q "^${KIND_CLUSTER_NAME}$$" || \
+	kind create cluster \
+	--image kindest/node:${KIND_K8S_VERSION} \
+	--name ${KIND_CLUSTER_NAME}  \
+	--config $(CURDIR)/test/kind/config.yaml
+	kubectl config use-context kind-${KIND_CLUSTER_NAME}
+
+# delete the kind cluster
+delete-kind:
+	kind delete cluster --name ${KIND_CLUSTER_NAME} || :
+
+.PHONY: values-schema test-image test-unit test-bats test test-acceptance test-destroy test-provision acceptance provision-cluster destroy-cluster
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/README.md b/charts/partners/hashicorp/vault/0.31.0/src/README.md
new file mode 100644
index 000000000..75d500918
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/README.md
@@ -0,0 +1,43 @@
+# Vault Helm Chart
+
+> :warning: **Please note**: We take Vault's security and our users' trust very seriously. If 
+you believe you have found a security issue in Vault Helm, _please responsibly disclose_ 
+by contacting us at [security@hashicorp.com](mailto:security@hashicorp.com).
+
+This repository contains the official HashiCorp Helm chart for installing
+and configuring Vault on Kubernetes. This chart supports multiple use
+cases of Vault on Kubernetes depending on the values provided.
+
+For full documentation on this Helm chart along with all the ways you can
+use Vault with Kubernetes, please see the
+[Vault and Kubernetes documentation](https://developer.hashicorp.com/vault/docs/platform/k8s).
+
+## Prerequisites
+
+To use the charts here, [Helm](https://helm.sh/) must be configured for your
+Kubernetes cluster. Setting up Kubernetes and Helm is outside the scope of
+this README. Please refer to the Kubernetes and Helm documentation.
+
+The versions required are:
+
+  * **Helm 3.6+**
+  * **Kubernetes 1.29+** - This is the earliest version of Kubernetes tested.
+    It is possible that this chart works with earlier versions but it is
+    untested.
+
+## Usage
+
+To install the latest version of this chart, add the Hashicorp helm repository
+and run `helm install`:
+
+```console
+$ helm repo add hashicorp https://helm.releases.hashicorp.com
+"hashicorp" has been added to your repositories
+
+$ helm install vault hashicorp/vault
+```
+
+Please see the many options supported in the `values.yaml` file. These are also
+fully documented directly on the [Vault
+website](https://developer.hashicorp.com/vault/docs/platform/k8s/helm) along with more
+detailed installation instructions.
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/NOTES.txt b/charts/partners/hashicorp/vault/0.31.0/src/templates/NOTES.txt
new file mode 100644
index 000000000..60d99a4e5
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/NOTES.txt
@@ -0,0 +1,14 @@
+
+Thank you for installing HashiCorp Vault!
+
+Now that you have deployed Vault, you should look over the docs on using
+Vault with Kubernetes available here:
+
+https://developer.hashicorp.com/vault/docs
+
+
+Your release is named {{ .Release.Name }}. To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get manifest {{ .Release.Name }}
+
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/_helpers.tpl b/charts/partners/hashicorp/vault/0.31.0/src/templates/_helpers.tpl
new file mode 100644
index 000000000..54c7a7350
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/_helpers.tpl
@@ -0,0 +1,1131 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to
+this (by the DNS naming spec). If release name contains chart name it will
+be used as a full name.
+*/}}
+{{- define "vault.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "vault.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "vault.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Allow the release namespace to be overridden
+*/}}
+{{- define "vault.namespace" -}}
+{{- default .Release.Namespace .Values.global.namespace -}}
+{{- end -}}
+
+{{/*
+Compute if the csi driver is enabled.
+*/}}
+{{- define "vault.csiEnabled" -}}
+{{- $_ := set . "csiEnabled" (or
+  (eq (.Values.csi.enabled | toString) "true")
+  (and (eq (.Values.csi.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the injector is enabled.
+*/}}
+{{- define "vault.injectorEnabled" -}}
+{{- $_ := set . "injectorEnabled" (or
+  (eq (.Values.injector.enabled | toString) "true")
+  (and (eq (.Values.injector.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server is enabled.
+*/}}
+{{- define "vault.serverEnabled" -}}
+{{- $_ := set . "serverEnabled" (or
+  (eq (.Values.server.enabled | toString) "true")
+  (and (eq (.Values.server.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server serviceaccount is enabled.
+*/}}
+{{- define "vault.serverServiceAccountEnabled" -}}
+{{- $_ := set . "serverServiceAccountEnabled"
+  (and
+    (eq (.Values.server.serviceAccount.create | toString) "true" )
+    (or
+      (eq (.Values.server.enabled | toString) "true")
+      (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server serviceaccount should have a token created and mounted to the serviceaccount.
+*/}}
+{{- define "vault.serverServiceAccountSecretCreationEnabled" -}}
+{{- $_ := set . "serverServiceAccountSecretCreationEnabled"
+  (and
+    (eq (.Values.server.serviceAccount.create | toString) "true")
+    (eq (.Values.server.serviceAccount.createSecret | toString) "true")) -}}
+{{- end -}}
+
+
+{{/*
+Compute if the server auth delegator serviceaccount is enabled.
+*/}}
+{{- define "vault.serverAuthDelegator" -}}
+{{- $_ := set . "serverAuthDelegator"
+  (and
+    (eq (.Values.server.authDelegator.enabled | toString) "true" )
+    (or (eq (.Values.server.serviceAccount.create | toString) "true")
+        (not (eq .Values.server.serviceAccount.name "")))
+    (or
+      (eq (.Values.server.enabled | toString) "true")
+      (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server service is enabled.
+*/}}
+{{- define "vault.serverServiceEnabled" -}}
+{{- template "vault.serverEnabled" . -}}
+{{- $_ := set . "serverServiceEnabled" (and .serverEnabled (eq (.Values.server.service.enabled | toString) "true")) -}}
+{{- end -}}
+
+{{/*
+Compute if the ui is enabled.
+*/}}
+{{- define "vault.uiEnabled" -}}
+{{- $_ := set . "uiEnabled" (or
+  (eq (.Values.ui.enabled | toString) "true")
+  (and (eq (.Values.ui.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute the maximum number of unavailable replicas for the PodDisruptionBudget.
+This defaults to (n/2)-1 where n is the number of members of the server cluster.
+Add a special case for replicas=1, where it should default to 0 as well.
+*/}}
+{{- define "vault.pdb.maxUnavailable" -}}
+{{- if eq (int .Values.server.ha.replicas) 1 -}}
+{{ 0 }}
+{{- else if .Values.server.ha.disruptionBudget.maxUnavailable -}}
+{{ .Values.server.ha.disruptionBudget.maxUnavailable -}}
+{{- else -}}
+{{- div (sub (div (mul (int .Values.server.ha.replicas) 10) 2) 1) 10 -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Set the variable 'mode' to the server mode requested by the user to simplify
+template logic.
+*/}}
+{{- define "vault.mode" -}}
+  {{- template "vault.serverEnabled" . -}}
+  {{- if or (.Values.injector.externalVaultAddr) (.Values.global.externalVaultAddr) -}}
+    {{- $_ := set . "mode" "external" -}}
+  {{- else if not .serverEnabled -}}
+    {{- $_ := set . "mode" "external" -}}
+  {{- else if eq (.Values.server.dev.enabled | toString) "true" -}}
+    {{- $_ := set . "mode" "dev" -}}
+  {{- else if eq (.Values.server.ha.enabled | toString) "true" -}}
+    {{- $_ := set . "mode" "ha" -}}
+  {{- else if or (eq (.Values.server.standalone.enabled | toString) "true") (eq (.Values.server.standalone.enabled | toString) "-") -}}
+    {{- $_ := set . "mode" "standalone" -}}
+  {{- else -}}
+    {{- $_ := set . "mode" "" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Set's the replica count based on the different modes configured by user
+*/}}
+{{- define "vault.replicas" -}}
+  {{ if eq .mode "standalone" }}
+    {{- default 1 -}}
+  {{ else if eq .mode "ha" }}
+    {{- if or (kindIs "int64" .Values.server.ha.replicas) (kindIs "float64" .Values.server.ha.replicas) -}}
+      {{- .Values.server.ha.replicas -}}
+    {{ else }}
+      {{- 3 -}}
+    {{- end -}}
+  {{ else }}
+    {{- default 1 -}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's up configmap mounts if this isn't a dev deployment and the user
+defined a custom configuration.  Additionally iterates over any
+extra volumes the user may have specified (such as a secret with TLS).
+*/}}
+{{- define "vault.volumes" -}}
+  {{- if and (ne .mode "dev") (or (.Values.server.standalone.config) (.Values.server.ha.config) (.Values.server.ha.raft.config)) }}
+        - name: config
+          configMap:
+            name: {{ template "vault.fullname" . }}-config
+  {{ end }}
+  {{- range .Values.server.extraVolumes }}
+        - name: userconfig-{{ .name }}
+          {{ .type }}:
+          {{- if (eq .type "configMap") }}
+            name: {{ .name }}
+          {{- else if (eq .type "secret") }}
+            secretName: {{ .name }}
+          {{- end }}
+            defaultMode: {{ .defaultMode | default 420 }}
+  {{- end }}
+  {{- if .Values.server.volumes }}
+    {{- toYaml .Values.server.volumes | nindent 8}}
+  {{- end }}
+  {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
+        - name: vault-license
+          secret:
+            secretName: {{ .Values.server.enterpriseLicense.secretName }}
+            defaultMode: 0440
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the args for custom command to render the Vault configuration
+file with IP addresses to make the out of box experience easier
+for users looking to use this chart with Consul Helm.
+*/}}
+{{- define "vault.args" -}}
+  {{ if or (eq .mode "standalone") (eq .mode "ha") }}
+          - |
+            cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
+            [ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
+            [ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
+            [ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
+            [ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
+            [ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
+            [ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
+            /usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl {{ .Values.server.extraArgs }}
+   {{ else if eq .mode "dev" }}
+          - |
+            /usr/local/bin/docker-entrypoint.sh vault server -dev {{ .Values.server.extraArgs }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's additional environment variables based on the mode.
+*/}}
+{{- define "vault.envs" -}}
+  {{ if eq .mode "dev" }}
+            - name: VAULT_DEV_ROOT_TOKEN_ID
+              value: {{ .Values.server.dev.devRootToken }}
+            - name: VAULT_DEV_LISTEN_ADDRESS
+              value: "[::]:8200"
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's which additional volumes should be mounted to the container
+based on the mode configured.
+*/}}
+{{- define "vault.mounts" -}}
+  {{ if eq (.Values.server.auditStorage.enabled | toString) "true" }}
+            - name: audit
+              mountPath: {{ .Values.server.auditStorage.mountPath }}
+  {{ end }}
+  {{ if or (eq .mode "standalone") (and (eq .mode "ha") (eq (.Values.server.ha.raft.enabled | toString) "true"))  }}
+    {{ if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+            - name: data
+              mountPath: {{ .Values.server.dataStorage.mountPath }}
+    {{ end }}
+  {{ end }}
+  {{ if and (ne .mode "dev") (or (.Values.server.standalone.config)  (.Values.server.ha.config)) }}
+            - name: config
+              mountPath: /vault/config
+  {{ end }}
+  {{- range .Values.server.extraVolumes }}
+            - name: userconfig-{{ .name }}
+              readOnly: true
+              mountPath: {{ .path | default "/vault/userconfig" }}/{{ .name }}
+  {{- end }}
+  {{- if .Values.server.volumeMounts }}
+    {{- toYaml .Values.server.volumeMounts | nindent 12}}
+  {{- end }}
+  {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
+            - name: vault-license
+              mountPath: /vault/license
+              readOnly: true
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's up the volumeClaimTemplates when data or audit storage is required.  HA
+might not use data storage since Consul is likely it's backend, however, audit
+storage might be desired by the user.
+*/}}
+{{- define "vault.volumeclaims" -}}
+  {{- if and (ne .mode "dev") (or .Values.server.dataStorage.enabled .Values.server.auditStorage.enabled) }}
+  volumeClaimTemplates:
+      {{- if and (eq (.Values.server.dataStorage.enabled | toString) "true") (or (eq .mode "standalone") (eq (.Values.server.ha.raft.enabled | toString ) "true" )) }}
+    - metadata:
+        name: data
+        {{- include "vault.dataVolumeClaim.annotations" . | nindent 6 }}
+        {{- include "vault.dataVolumeClaim.labels" . | nindent 6 }}
+      spec:
+        accessModes:
+          - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }}
+        resources:
+          requests:
+            storage: {{ .Values.server.dataStorage.size }}
+          {{- if .Values.server.dataStorage.storageClass }}
+        storageClassName: {{ .Values.server.dataStorage.storageClass }}
+          {{- end }}
+      {{ end }}
+      {{- if eq (.Values.server.auditStorage.enabled | toString) "true" }}
+    - metadata:
+        name: audit
+        {{- include "vault.auditVolumeClaim.annotations" . | nindent 6 }}
+        {{- include "vault.auditVolumeClaim.labels" . | nindent 6 }}
+      spec:
+        accessModes:
+          - {{ .Values.server.auditStorage.accessMode | default "ReadWriteOnce" }}
+        resources:
+          requests:
+            storage: {{ .Values.server.auditStorage.size }}
+          {{- if .Values.server.auditStorage.storageClass }}
+        storageClassName: {{ .Values.server.auditStorage.storageClass }}
+          {{- end }}
+      {{ end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Set's the affinity for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "vault.affinity" -}}
+  {{- if and (ne .mode "dev") .Values.server.affinity }}
+      affinity:
+        {{ $tp := typeOf .Values.server.affinity }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.affinity . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.server.affinity | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the injector affinity for pod placement
+*/}}
+{{- define "injector.affinity" -}}
+  {{- if .Values.injector.affinity }}
+      affinity:
+        {{ $tp := typeOf .Values.injector.affinity }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.affinity . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.injector.affinity | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the topologySpreadConstraints when running in standalone and HA modes.
+*/}}
+{{- define "vault.topologySpreadConstraints" -}}
+  {{- if and (ne .mode "dev") .Values.server.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{ $tp := typeOf .Values.server.topologySpreadConstraints }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.topologySpreadConstraints . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.server.topologySpreadConstraints | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+
+{{/*
+Sets the injector topologySpreadConstraints for pod placement
+*/}}
+{{- define "injector.topologySpreadConstraints" -}}
+  {{- if .Values.injector.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{ $tp := typeOf .Values.injector.topologySpreadConstraints }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.topologySpreadConstraints . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.injector.topologySpreadConstraints | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the toleration for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "vault.tolerations" -}}
+  {{- if and (ne .mode "dev") .Values.server.tolerations }}
+      tolerations:
+      {{- $tp := typeOf .Values.server.tolerations }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.server.tolerations . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.server.tolerations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector toleration for pod placement
+*/}}
+{{- define "injector.tolerations" -}}
+  {{- if .Values.injector.tolerations }}
+      tolerations:
+      {{- $tp := typeOf .Values.injector.tolerations }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.injector.tolerations . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.injector.tolerations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the node selector for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "vault.nodeselector" -}}
+  {{- if and (ne .mode "dev") .Values.server.nodeSelector }}
+      nodeSelector:
+      {{- $tp := typeOf .Values.server.nodeSelector }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.server.nodeSelector . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.server.nodeSelector | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector node selector for pod placement
+*/}}
+{{- define "injector.nodeselector" -}}
+  {{- if .Values.injector.nodeSelector }}
+      nodeSelector:
+      {{- $tp := typeOf .Values.injector.nodeSelector }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.injector.nodeSelector . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.injector.nodeSelector | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector deployment update strategy
+*/}}
+{{- define "injector.strategy" -}}
+  {{- if .Values.injector.strategy }}
+  strategy:
+  {{- $tp := typeOf .Values.injector.strategy }}
+  {{- if eq $tp "string" }}
+    {{ tpl .Values.injector.strategy . | nindent 4 | trim }}
+  {{- else }}
+    {{- toYaml .Values.injector.strategy | nindent 4 }}
+  {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra pod annotations
+*/}}
+{{- define "vault.annotations" }}
+      annotations:
+  {{- if .Values.server.includeConfigAnnotation }}
+        vault.hashicorp.com/config-checksum: {{ include "vault.config" . | sha256sum }}
+  {{- end }}
+  {{- if .Values.server.annotations }}
+        {{- $tp := typeOf .Values.server.annotations }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.annotations . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.server.annotations | nindent 8 }}
+        {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector pod annotations
+*/}}
+{{- define "injector.annotations" -}}
+  {{- if .Values.injector.annotations }}
+      annotations:
+        {{- $tp := typeOf .Values.injector.annotations }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.annotations . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.injector.annotations | nindent 8 }}
+        {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector service annotations
+*/}}
+{{- define "injector.service.annotations" -}}
+  {{- if .Values.injector.service.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.injector.service.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.injector.service.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.injector.service.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the injector pod level.
+*/}}
+{{- define "injector.securityContext.pod" -}}
+  {{- if .Values.injector.securityContext.pod }}
+      securityContext:
+        {{- $tp := typeOf .Values.injector.securityContext.pod }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.injector.securityContext.pod . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.injector.securityContext.pod | nindent 8 }}
+        {{- end }}
+  {{- else if not .Values.global.openshift }}
+      securityContext:
+        runAsNonRoot: true
+        runAsGroup: {{ .Values.injector.gid | default 1000 }}
+        runAsUser: {{ .Values.injector.uid | default 100 }}
+        fsGroup: {{ .Values.injector.gid | default 1000 }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the injector container level.
+*/}}
+{{- define "injector.securityContext.container" -}}
+  {{- if .Values.injector.securityContext.container}}
+          securityContext:
+            {{- $tp := typeOf .Values.injector.securityContext.container }}
+            {{- if eq $tp "string" }}
+              {{- tpl .Values.injector.securityContext.container . | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.injector.securityContext.container | nindent 12 }}
+            {{- end }}
+  {{- else if not .Values.global.openshift }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the statefulset pod template.
+*/}}
+{{- define "server.statefulSet.securityContext.pod" -}}
+  {{- if .Values.server.statefulSet.securityContext.pod }}
+      securityContext:
+        {{- $tp := typeOf .Values.server.statefulSet.securityContext.pod }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.server.statefulSet.securityContext.pod . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.server.statefulSet.securityContext.pod | nindent 8 }}
+        {{- end }}
+  {{- else if not .Values.global.openshift }}
+      securityContext:
+        runAsNonRoot: true
+        runAsGroup: {{ .Values.server.gid | default 1000 }}
+        runAsUser: {{ .Values.server.uid | default 100 }}
+        fsGroup: {{ .Values.server.gid | default 1000 }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the statefulset vault container
+*/}}
+{{- define "server.statefulSet.securityContext.container" -}}
+  {{- if .Values.server.statefulSet.securityContext.container }}
+          securityContext:
+            {{- $tp := typeOf .Values.server.statefulSet.securityContext.container }}
+            {{- if eq $tp "string" }}
+              {{- tpl .Values.server.statefulSet.securityContext.container . | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.server.statefulSet.securityContext.container | nindent 12 }}
+            {{- end }}
+  {{- else if not .Values.global.openshift }}
+          securityContext:
+            allowPrivilegeEscalation: false
+  {{- end }}
+{{- end -}}
+
+
+{{/*
+Sets extra injector service account annotations
+*/}}
+{{- define "injector.serviceAccount.annotations" -}}
+  {{- if and (ne .mode "dev") .Values.injector.serviceAccount.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.injector.serviceAccount.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.injector.serviceAccount.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.injector.serviceAccount.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector webhook annotations
+*/}}
+{{- define "injector.webhookAnnotations" -}}
+  {{- if or (((.Values.injector.webhook)).annotations) (.Values.injector.webhookAnnotations)  }}
+  annotations:
+    {{- $tp := typeOf (or (((.Values.injector.webhook)).annotations) (.Values.injector.webhookAnnotations)) }}
+    {{- if eq $tp "string" }}
+      {{- tpl (((.Values.injector.webhook)).annotations | default .Values.injector.webhookAnnotations) . | nindent 4 }}
+    {{- else }}
+      {{- toYaml (((.Values.injector.webhook)).annotations | default .Values.injector.webhookAnnotations) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the injector webhook objectSelector
+*/}}
+{{- define "injector.objectSelector" -}}
+  {{- $v := or (((.Values.injector.webhook)).objectSelector) (.Values.injector.objectSelector) -}}
+  {{ if $v }}
+    objectSelector:
+    {{- $tp := typeOf $v -}}
+    {{ if eq $tp "string" }}
+      {{ tpl $v . | indent 6 | trim }}
+    {{ else }}
+      {{ toYaml $v | indent 6 | trim }}
+    {{ end }}
+  {{ end }}
+{{ end }}
+
+{{/*
+Sets extra ui service annotations
+*/}}
+{{- define "vault.ui.annotations" -}}
+  {{- if .Values.ui.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.ui.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.ui.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.ui.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "vault.serviceAccount.name" -}}
+{{- if .Values.server.serviceAccount.create -}}
+    {{ default (include "vault.fullname" .) .Values.server.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.server.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Sets extra service account annotations
+*/}}
+{{- define "vault.serviceAccount.annotations" -}}
+  {{- if and (ne .mode "dev") .Values.server.serviceAccount.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.server.serviceAccount.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.serviceAccount.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.serviceAccount.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra ingress annotations
+*/}}
+{{- define "vault.ingress.annotations" -}}
+  {{- if .Values.server.ingress.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.server.ingress.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.ingress.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.ingress.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra route annotations
+*/}}
+{{- define "vault.route.annotations" -}}
+  {{- if .Values.server.route.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.server.route.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.route.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.route.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra vault server Service annotations
+*/}}
+{{- define "vault.service.annotations" -}}
+  {{- if .Values.server.service.annotations }}
+    {{- $tp := typeOf .Values.server.service.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.service.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.service.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra vault server Service (active) annotations
+*/}}
+{{- define "vault.service.active.annotations" -}}
+  {{- if .Values.server.service.active.annotations }}
+    {{- $tp := typeOf .Values.server.service.active.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.service.active.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.service.active.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+{{/*
+Sets extra vault server Service annotations
+*/}}
+{{- define "vault.service.standby.annotations" -}}
+  {{- if .Values.server.service.standby.annotations }}
+    {{- $tp := typeOf .Values.server.service.standby.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.service.standby.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.service.standby.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets PodSecurityPolicy annotations
+*/}}
+{{- define "vault.psp.annotations" -}}
+  {{- if .Values.global.psp.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.global.psp.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.global.psp.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.global.psp.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra statefulset annotations
+*/}}
+{{- define "vault.statefulSet.annotations" -}}
+  {{- if .Values.server.statefulSet.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.server.statefulSet.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.statefulSet.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.statefulSet.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim annotations for data volume
+*/}}
+{{- define "vault.dataVolumeClaim.annotations" -}}
+  {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) (.Values.server.dataStorage.annotations) }}
+  annotations:
+    {{- $tp := typeOf .Values.server.dataStorage.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.dataStorage.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.dataStorage.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim labels for data volume
+*/}}
+{{- define "vault.dataVolumeClaim.labels" -}}
+  {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) (.Values.server.dataStorage.labels) }}
+  labels:
+    {{- $tp := typeOf .Values.server.dataStorage.labels }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.dataStorage.labels . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.dataStorage.labels | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim annotations for audit volume
+*/}}
+{{- define "vault.auditVolumeClaim.annotations" -}}
+  {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) (.Values.server.auditStorage.annotations) }}
+  annotations:
+    {{- $tp := typeOf .Values.server.auditStorage.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.auditStorage.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.auditStorage.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim labels for audit volume
+*/}}
+{{- define "vault.auditVolumeClaim.labels" -}}
+  {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) (.Values.server.auditStorage.labels) }}
+  labels:
+    {{- $tp := typeOf .Values.server.auditStorage.labels }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.server.auditStorage.labels . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.server.auditStorage.labels | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Set's the container resources if the user has set any.
+*/}}
+{{- define "vault.resources" -}}
+  {{- if .Values.server.resources -}}
+          resources:
+{{ toYaml .Values.server.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources if the user has set any.
+*/}}
+{{- define "injector.resources" -}}
+  {{- if .Values.injector.resources -}}
+          resources:
+{{ toYaml .Values.injector.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources if the user has set any.
+*/}}
+{{- define "csi.resources" -}}
+  {{- if .Values.csi.resources -}}
+          resources:
+{{ toYaml .Values.csi.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources for CSI's Agent sidecar if the user has set any.
+*/}}
+{{- define "csi.agent.resources" -}}
+  {{- if .Values.csi.agent.resources -}}
+          resources:
+{{ toYaml .Values.csi.agent.resources | indent 12}}
+  {{ end }}
+{{- end -}}
+
+{{/*
+Sets extra CSI daemonset annotations
+*/}}
+{{- define "csi.daemonSet.annotations" -}}
+  {{- if .Values.csi.daemonSet.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.csi.daemonSet.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.csi.daemonSet.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.csi.daemonSet.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI daemonset securityContext for pod template
+*/}}
+{{- define "csi.daemonSet.securityContext.pod" -}}
+  {{- if .Values.csi.daemonSet.securityContext.pod }}
+      securityContext:
+    {{- $tp := typeOf .Values.csi.daemonSet.securityContext.pod }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.csi.daemonSet.securityContext.pod . | nindent 8 }}
+    {{- else }}
+      {{- toYaml .Values.csi.daemonSet.securityContext.pod | nindent 8 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI daemonset securityContext for container
+*/}}
+{{- define "csi.daemonSet.securityContext.container" -}}
+  {{- if .Values.csi.daemonSet.securityContext.container }}
+          securityContext:
+    {{- $tp := typeOf .Values.csi.daemonSet.securityContext.container }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.csi.daemonSet.securityContext.container . | nindent 12 }}
+    {{- else }}
+      {{- toYaml .Values.csi.daemonSet.securityContext.container | nindent 12 }}
+    {{- end }}
+  {{- else if .Values.global.openshift }}
+          securityContext:
+            privileged: true
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI Vault Agent container securityContext
+*/}}
+{{- define "csi.agent.securityContext.container" -}}
+  {{- if .Values.csi.agent.securityContext.container }}
+          securityContext:
+            {{- $tp := typeOf .Values.csi.agent.securityContext.container }}
+            {{- if eq $tp "string" }}
+              {{- tpl .Values.csi.agent.securityContext.container . | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.csi.agent.securityContext.container | nindent 12 }}
+            {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector toleration for pod placement
+*/}}
+{{- define "csi.pod.tolerations" -}}
+  {{- if .Values.csi.pod.tolerations }}
+      tolerations:
+      {{- $tp := typeOf .Values.csi.pod.tolerations }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.csi.pod.tolerations . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.csi.pod.tolerations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets the CSI provider nodeSelector for pod placement
+*/}}
+{{- define "csi.pod.nodeselector" -}}
+  {{- if .Values.csi.pod.nodeSelector }}
+      nodeSelector:
+      {{- $tp := typeOf .Values.csi.pod.nodeSelector }}
+      {{- if eq $tp "string" }}
+        {{ tpl .Values.csi.pod.nodeSelector . | nindent 8 | trim }}
+      {{- else }}
+        {{- toYaml .Values.csi.pod.nodeSelector | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+{{/*
+Sets the CSI provider affinity for pod placement.
+*/}}
+{{- define "csi.pod.affinity" -}}
+  {{- if .Values.csi.pod.affinity }}
+      affinity:
+        {{ $tp := typeOf .Values.csi.pod.affinity }}
+        {{- if eq $tp "string" }}
+          {{- tpl .Values.csi.pod.affinity . | nindent 8 | trim }}
+        {{- else }}
+          {{- toYaml .Values.csi.pod.affinity | nindent 8 }}
+        {{- end }}
+  {{ end }}
+{{- end -}}
+{{/*
+Sets extra CSI provider pod annotations
+*/}}
+{{- define "csi.pod.annotations" -}}
+  {{- if .Values.csi.pod.annotations }}
+      annotations:
+      {{- $tp := typeOf .Values.csi.pod.annotations }}
+      {{- if eq $tp "string" }}
+        {{- tpl .Values.csi.pod.annotations . | nindent 8 }}
+      {{- else }}
+        {{- toYaml .Values.csi.pod.annotations | nindent 8 }}
+      {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra CSI service account annotations
+*/}}
+{{- define "csi.serviceAccount.annotations" -}}
+  {{- if .Values.csi.serviceAccount.annotations }}
+  annotations:
+    {{- $tp := typeOf .Values.csi.serviceAccount.annotations }}
+    {{- if eq $tp "string" }}
+      {{- tpl .Values.csi.serviceAccount.annotations . | nindent 4 }}
+    {{- else }}
+      {{- toYaml .Values.csi.serviceAccount.annotations | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Inject extra environment vars in the format key:value, if populated
+*/}}
+{{- define "vault.extraEnvironmentVars" -}}
+{{- if .extraEnvironmentVars -}}
+{{- range $key, $value := .extraEnvironmentVars }}
+- name: {{ printf "%s" $key | replace "." "_" | upper | quote }}
+  value: {{ $value | quote }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Inject extra environment populated by secrets, if populated
+*/}}
+{{- define "vault.extraSecretEnvironmentVars" -}}
+{{- if .extraSecretEnvironmentVars -}}
+{{- range .extraSecretEnvironmentVars }}
+- name: {{ .envName }}
+  valueFrom:
+   secretKeyRef:
+     name: {{ .secretName }}
+     key: {{ .secretKey }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Scheme for health check and local endpoint */}}
+{{- define "vault.scheme" -}}
+{{- if .Values.global.tlsDisable -}}
+{{ "http" }}
+{{- else -}}
+{{ "https" }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+imagePullSecrets generates pull secrets from either string or map values.
+A map value must be indexable by the key 'name'.
+*/}}
+{{- define "imagePullSecrets" -}}
+{{- with .Values.global.imagePullSecrets -}}
+imagePullSecrets:
+{{- range . -}}
+{{- if typeIs "string" . }}
+  - name: {{ . }}
+{{- else if index . "name" }}
+  - name: {{ .name }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+externalTrafficPolicy sets a Service's externalTrafficPolicy if applicable.
+Supported inputs are Values.server.service and Values.ui
+*/}}
+{{- define "service.externalTrafficPolicy" -}}
+{{- $type := "" -}}
+{{- if .serviceType -}}
+{{- $type = .serviceType -}}
+{{- else if .type -}}
+{{- $type = .type -}}
+{{- end -}}
+{{- if and .externalTrafficPolicy (or (eq $type "LoadBalancer") (eq $type "NodePort")) }}
+  externalTrafficPolicy: {{ .externalTrafficPolicy }}
+{{- else }}
+{{- end }}
+{{- end -}}
+
+{{/*
+loadBalancer configuration for the the UI service.
+Supported inputs are Values.ui
+*/}}
+{{- define "service.loadBalancer" -}}
+{{- if  eq (.serviceType | toString) "LoadBalancer" }}
+{{- if .loadBalancerIP }}
+  loadBalancerIP: {{ .loadBalancerIP }}
+{{- end }}
+{{- with .loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{- range . }}
+  - {{ . }}
+{{- end }}
+{{- end -}}
+{{- end }}
+{{- end -}}
+
+{{/*
+config file from values
+*/}}
+{{- define "vault.config" -}}
+{{- if or (eq .mode "ha") (eq .mode "standalone") }}
+{{- $config := (index .Values.server .mode).config -}}
+{{- if .Values.server.ha.raft.enabled -}}
+{{- $config = .Values.server.ha.raft.config -}}
+{{- end -}}
+{{- $type := typeOf $config -}}
+{{- if eq $type "string" -}}
+{{/* Vault supports both HCL and JSON as its configuration format */}}
+{{- $json := tpl $config . | fromJson -}}
+{{/*
+Helm's fromJson does not behave according to the corresponding sprig function nor Helm docs,
+which claim that it should return empty string on invalid JSON, it actually returns
+a map containing a single 'Error' element.
+https://github.com/helm/helm/blob/50c22ed7f953fadb32755e5881ba95a92da852b2/pkg/engine/funcs.go#L158
+ */}}
+{{- if or (and (eq ($json | len) 1) (hasKey $json "Error")) (eq ($json | len) 0) -}}
+{{- $config = printf "%s\n%s" $config "disable_mlock = true" -}}
+{{- else -}}
+{{- if not (hasKey $json "disable_mlock") -}}
+{{- $_ := set $json "disable_mlock" true -}}
+{{- end -}}
+{{- $config = $json | mustToJson -}}
+{{- end -}}
+{{- else }}
+{{- fail "structured server config is not supported, value must be a string"}}
+{{- end }}
+{{- tpl $config . | nindent 4 | trim }}
+{{- end -}}
+{{- end -}}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-agent-configmap.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-agent-configmap.yaml
new file mode 100644
index 000000000..18cdb04ac
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-agent-configmap.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if and (.csiEnabled) (eq (.Values.csi.agent.enabled | toString) "true") -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider-agent-config
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+data:
+  config.hcl: |
+    vault {
+        {{- if .Values.global.externalVaultAddr }}
+        "address" = "{{ .Values.global.externalVaultAddr }}"
+        {{- else }}
+        "address" = "{{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}"
+        {{- end }}
+    }
+
+    cache {}
+
+    listener "unix" {
+        address = "/var/run/vault/agent.sock"
+        tls_disable = true
+    }
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-clusterrole.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-clusterrole.yaml
new file mode 100644
index 000000000..6d979ea40
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-clusterrole.yaml
@@ -0,0 +1,23 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider-clusterrole
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-clusterrolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-clusterrolebinding.yaml
new file mode 100644
index 000000000..506ec944a
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-clusterrolebinding.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider-clusterrolebinding
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "vault.fullname" . }}-csi-provider-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: {{ template "vault.fullname" . }}-csi-provider
+  namespace: {{ include "vault.namespace" . }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-daemonset.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-daemonset.yaml
new file mode 100644
index 000000000..3fd0c9eaf
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-daemonset.yaml
@@ -0,0 +1,157 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.csi.daemonSet.extraLabels -}}
+      {{- toYaml .Values.csi.daemonSet.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "csi.daemonSet.annotations" . }}
+spec:
+  updateStrategy:
+    type: {{ .Values.csi.daemonSet.updateStrategy.type }}
+    {{- if .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
+    rollingUpdate:
+      maxUnavailable: {{ .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
+    {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ template "vault.name" . }}-csi-provider
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if  .Values.csi.pod.extraLabels -}}
+          {{- toYaml .Values.csi.pod.extraLabels | nindent 8 -}}
+        {{- end -}}
+      {{ template "csi.pod.annotations" . }}
+    spec:
+      {{ template "csi.daemonSet.securityContext.pod" . }}
+      {{- if .Values.csi.priorityClassName }}
+      priorityClassName: {{ .Values.csi.priorityClassName }}
+      {{- end }}
+      hostNetwork: {{ .Values.csi.hostNetwork }}
+      serviceAccountName: {{ template "vault.fullname" . }}-csi-provider
+      {{- template "csi.pod.tolerations" . }}
+      {{- template "csi.pod.nodeselector" . }}
+      {{- template "csi.pod.affinity" . }}
+      containers:
+        - name: {{ include "vault.name" . }}-csi-provider
+          {{ template "csi.resources" . }}
+          {{ template "csi.daemonSet.securityContext.container" . }}
+          image: "{{ .Values.csi.image.repository }}:{{ .Values.csi.image.tag }}"
+          imagePullPolicy: {{ .Values.csi.image.pullPolicy }}
+          args:
+            - --endpoint=/provider/vault.sock
+            {{- if .Values.csi.debug }}
+            - --log-level=debug
+            {{- else }}
+            - --log-level={{ .Values.csi.logLevel }}
+            {{- end }}
+            {{- if .Values.csi.hmacSecretName }}
+            - --hmac-secret-name={{ .Values.csi.hmacSecretName }}
+            {{- else }}
+            - --hmac-secret-name={{- include "vault.name" . }}-csi-provider-hmac-key
+            {{- end }}
+            {{- if .Values.csi.extraArgs }}
+            {{- toYaml .Values.csi.extraArgs | nindent 12 }}
+            {{- end }}
+          env:
+            - name: VAULT_ADDR
+            {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+              value: "unix:///var/run/vault/agent.sock"
+            {{- else if .Values.global.externalVaultAddr }}
+              value: "{{ .Values.global.externalVaultAddr }}"
+            {{- else }}
+              value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
+            {{- end }}
+          volumeMounts:
+            - name: providervol
+              mountPath: "/provider"
+            {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+            - name: agent-unix-socket
+              mountPath: /var/run/vault
+            {{- end }}
+            {{- if .Values.csi.volumeMounts }}
+              {{- toYaml .Values.csi.volumeMounts | nindent 12}}
+            {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /health/ready
+              port: 8080
+            failureThreshold: {{ .Values.csi.livenessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.csi.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.csi.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.csi.livenessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.csi.livenessProbe.timeoutSeconds }}
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: 8080
+            failureThreshold: {{ .Values.csi.readinessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.csi.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.csi.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.csi.readinessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.csi.readinessProbe.timeoutSeconds }}
+        {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+        - name: {{ include "vault.name" . }}-agent
+          image: "{{ .Values.csi.agent.image.repository }}:{{ .Values.csi.agent.image.tag }}"
+          imagePullPolicy: {{ .Values.csi.agent.image.pullPolicy }}
+          {{ template "csi.agent.resources" . }}
+          command:
+            - vault
+          args:
+            - agent
+            - -config=/etc/vault/config.hcl
+            {{- if .Values.csi.agent.extraArgs }}
+            {{- toYaml .Values.csi.agent.extraArgs | nindent 12 }}
+            {{- end }}
+          ports:
+            - containerPort: 8200
+          env:
+            - name: VAULT_LOG_LEVEL
+              value: "{{ .Values.csi.agent.logLevel }}"
+            - name: VAULT_LOG_FORMAT
+              value: "{{ .Values.csi.agent.logFormat }}"
+          {{- template "csi.agent.securityContext.container" . }}
+          volumeMounts:
+            - name: agent-config
+              mountPath: /etc/vault/config.hcl
+              subPath: config.hcl
+              readOnly: true
+            - name: agent-unix-socket
+              mountPath: /var/run/vault
+            {{- if .Values.csi.volumeMounts }}
+            {{- toYaml .Values.csi.volumeMounts | nindent 12 }}
+            {{- end }}
+        {{- end }}
+      volumes:
+        - name: providervol
+          hostPath:
+            path: {{ .Values.csi.daemonSet.providersDir }}
+        {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+        - name: agent-config
+          configMap:
+            name: {{ template "vault.fullname" . }}-csi-provider-agent-config
+        - name: agent-unix-socket
+          emptyDir:
+            medium: Memory
+        {{- end }}
+        {{- if .Values.csi.volumes }}
+        {{- toYaml .Values.csi.volumes | nindent 8}}
+        {{- end }}
+      {{- include "imagePullSecrets" . | nindent 6 }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-role.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-role.yaml
new file mode 100644
index 000000000..17e1918b4
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-role.yaml
@@ -0,0 +1,32 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider-role
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames:
+    {{- if .Values.csi.hmacSecretName }}
+    - {{ .Values.csi.hmacSecretName }}
+    {{- else }}
+    - {{ include "vault.name" . }}-csi-provider-hmac-key
+    {{- end }}
+# 'create' permissions cannot be restricted by resource name:
+# https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create"]
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-rolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-rolebinding.yaml
new file mode 100644
index 000000000..3d3b981b8
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-rolebinding.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider-rolebinding
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "vault.fullname" . }}-csi-provider-role
+subjects:
+- kind: ServiceAccount
+  name: {{ template "vault.fullname" . }}-csi-provider
+  namespace: {{ include "vault.namespace" . }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-serviceaccount.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-serviceaccount.yaml
new file mode 100644
index 000000000..6327a7b2f
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/csi-serviceaccount.yaml
@@ -0,0 +1,21 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "vault.fullname" . }}-csi-provider
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.csi.serviceAccount.extraLabels -}}
+      {{- toYaml .Values.csi.serviceAccount.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "csi.serviceAccount.annotations" . }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-certs-secret.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-certs-secret.yaml
new file mode 100644
index 000000000..f6995af10
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-certs-secret.yaml
@@ -0,0 +1,19 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vault-injector-certs
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-clusterrole.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-clusterrole.yaml
new file mode 100644
index 000000000..df603f250
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-clusterrole.yaml
@@ -0,0 +1,30 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-clusterrole
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["mutatingwebhookconfigurations"]
+  verbs:
+    - "get"
+    - "list"
+    - "watch"
+    - "patch"
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs:
+    - "get"
+{{ end }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-clusterrolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-clusterrolebinding.yaml
new file mode 100644
index 000000000..82cbce0ce
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-clusterrolebinding.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-binding
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "vault.fullname" . }}-agent-injector-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: {{ template "vault.fullname" . }}-agent-injector
+  namespace: {{ include "vault.namespace" . }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-deployment.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-deployment.yaml
new file mode 100644
index 000000000..822e8e41d
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-deployment.yaml
@@ -0,0 +1,179 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+# Deployment for the injector
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    component: webhook
+spec:
+  replicas: {{ .Values.injector.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: webhook
+  {{ template "injector.strategy" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        component: webhook
+        {{- if  .Values.injector.extraLabels -}}
+          {{- toYaml .Values.injector.extraLabels | nindent 8 -}}
+        {{- end -}}
+      {{ template "injector.annotations" . }}
+    spec:
+      {{ template "injector.affinity" . }}
+      {{ template "injector.topologySpreadConstraints" . }}
+      {{ template "injector.tolerations" . }}
+      {{ template "injector.nodeselector" . }}
+      {{- if .Values.injector.priorityClassName }}
+      priorityClassName: {{ .Values.injector.priorityClassName }}
+      {{- end }}
+      serviceAccountName: "{{ template "vault.fullname" . }}-agent-injector"
+      {{ template "injector.securityContext.pod" . -}}
+      {{- if not .Values.global.openshift }}
+      hostNetwork: {{ .Values.injector.hostNetwork }}
+      {{- end }}
+      containers:
+        - name: sidecar-injector
+          {{ template "injector.resources" . }}
+          image: "{{ .Values.injector.image.repository }}:{{ .Values.injector.image.tag }}"
+          imagePullPolicy: "{{ .Values.injector.image.pullPolicy }}"
+          {{- template "injector.securityContext.container" . }}
+          env:
+            - name: AGENT_INJECT_LISTEN
+              value: {{ printf ":%v" .Values.injector.port  }}
+            - name: AGENT_INJECT_LOG_LEVEL
+              value: {{ .Values.injector.logLevel | default "info" }}
+            - name: AGENT_INJECT_VAULT_ADDR
+            {{- if .Values.global.externalVaultAddr }}
+              value: "{{ .Values.global.externalVaultAddr }}"
+            {{- else if .Values.injector.externalVaultAddr }}
+              value: "{{ .Values.injector.externalVaultAddr }}"
+            {{- else }}
+              value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
+            {{- end }}
+            - name: AGENT_INJECT_VAULT_AUTH_PATH
+              value: {{ .Values.injector.authPath }}
+            - name: AGENT_INJECT_VAULT_IMAGE
+              value: "{{ .Values.injector.agentImage.repository }}:{{ .Values.injector.agentImage.tag }}"
+            {{- if .Values.injector.certs.secretName }}
+            - name: AGENT_INJECT_TLS_CERT_FILE
+              value: "/etc/webhook/certs/{{ .Values.injector.certs.certName }}"
+            - name: AGENT_INJECT_TLS_KEY_FILE
+              value: "/etc/webhook/certs/{{ .Values.injector.certs.keyName }}"
+            {{- else }}
+            - name: AGENT_INJECT_TLS_AUTO
+              value: {{ template "vault.fullname" . }}-agent-injector-cfg
+            - name: AGENT_INJECT_TLS_AUTO_HOSTS
+              value: {{ template "vault.fullname" . }}-agent-injector-svc,{{ template "vault.fullname" . }}-agent-injector-svc.{{ include "vault.namespace" . }},{{ template "vault.fullname" . }}-agent-injector-svc.{{ include "vault.namespace" . }}.svc
+            {{- end }}
+            - name: AGENT_INJECT_LOG_FORMAT
+              value: {{ .Values.injector.logFormat | default "standard" }}
+            - name: AGENT_INJECT_REVOKE_ON_SHUTDOWN
+              value: "{{ .Values.injector.revokeOnShutdown | default false }}"
+            {{- if .Values.global.openshift }}
+            - name: AGENT_INJECT_SET_SECURITY_CONTEXT
+              value: "false"
+            {{- end }}
+            {{- if .Values.injector.metrics.enabled }}
+            - name: AGENT_INJECT_TELEMETRY_PATH
+              value: "/metrics"
+            {{- end }}
+            {{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+            - name: AGENT_INJECT_USE_LEADER_ELECTOR
+              value: "true"
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- end }}
+            - name: AGENT_INJECT_CPU_REQUEST
+              value: "{{ .Values.injector.agentDefaults.cpuRequest }}"
+            - name: AGENT_INJECT_CPU_LIMIT
+              value: "{{ .Values.injector.agentDefaults.cpuLimit }}"
+            - name: AGENT_INJECT_MEM_REQUEST
+              value: "{{ .Values.injector.agentDefaults.memRequest }}"
+            - name: AGENT_INJECT_MEM_LIMIT
+              value: "{{ .Values.injector.agentDefaults.memLimit }}"
+            {{- if .Values.injector.agentDefaults.ephemeralRequest }}
+            - name: AGENT_INJECT_EPHEMERAL_REQUEST
+              value: "{{ .Values.injector.agentDefaults.ephemeralRequest }}"
+            {{- end }}
+            {{- if .Values.injector.agentDefaults.ephemeralLimit }}
+            - name: AGENT_INJECT_EPHEMERAL_LIMIT
+              value: "{{ .Values.injector.agentDefaults.ephemeralLimit }}"
+            {{- end }}
+            - name: AGENT_INJECT_DEFAULT_TEMPLATE
+              value: "{{ .Values.injector.agentDefaults.template }}"
+            - name: AGENT_INJECT_TEMPLATE_CONFIG_EXIT_ON_RETRY_FAILURE
+              value: "{{ .Values.injector.agentDefaults.templateConfig.exitOnRetryFailure }}"
+            {{- if .Values.injector.agentDefaults.templateConfig.staticSecretRenderInterval }}
+            - name: AGENT_INJECT_TEMPLATE_STATIC_SECRET_RENDER_INTERVAL
+              value: "{{ .Values.injector.agentDefaults.templateConfig.staticSecretRenderInterval }}"
+            {{- end }}
+            {{- include "vault.extraEnvironmentVars" .Values.injector | nindent 12 }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          args:
+            - agent-inject
+            - 2>&1
+          livenessProbe:
+            httpGet:
+              path: /health/ready
+              port: {{ .Values.injector.port }}
+              scheme: HTTPS
+            failureThreshold: {{ .Values.injector.livenessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.injector.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.injector.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.injector.livenessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.injector.livenessProbe.timeoutSeconds }}
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: {{ .Values.injector.port }}
+              scheme: HTTPS
+            failureThreshold: {{ .Values.injector.readinessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.injector.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.injector.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.injector.readinessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.injector.readinessProbe.timeoutSeconds }}
+          startupProbe:
+            httpGet:
+              path: /health/ready
+              port: {{ .Values.injector.port }}
+              scheme: HTTPS
+            failureThreshold: {{ .Values.injector.startupProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.injector.startupProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.injector.startupProbe.periodSeconds }}
+            successThreshold: {{ .Values.injector.startupProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.injector.startupProbe.timeoutSeconds }}
+{{- if .Values.injector.certs.secretName }}
+          volumeMounts:
+            - name: webhook-certs
+              mountPath: /etc/webhook/certs
+              readOnly: true
+{{- end }}
+{{- if .Values.injector.certs.secretName }}
+      volumes:
+        - name: webhook-certs
+          secret:
+            secretName: "{{ .Values.injector.certs.secretName }}"
+{{- end }}
+      {{- include "imagePullSecrets" . | nindent 6 }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-disruptionbudget.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-disruptionbudget.yaml
new file mode 100644
index 000000000..2b2a61c6f
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-disruptionbudget.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if .Values.injector.podDisruptionBudget }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    component: webhook
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: webhook
+  {{- toYaml .Values.injector.podDisruptionBudget | nindent 2 }}
+{{- end -}}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-mutating-webhook.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-mutating-webhook.yaml
new file mode 100644
index 000000000..d0cafa66f
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-mutating-webhook.yaml
@@ -0,0 +1,45 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1" }}
+apiVersion: admissionregistration.k8s.io/v1
+{{- else }}
+apiVersion: admissionregistration.k8s.io/v1beta1
+{{- end }}
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-cfg
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- template "injector.webhookAnnotations" . }}
+webhooks:
+  - name: vault.hashicorp.com
+    failurePolicy: {{ ((.Values.injector.webhook)).failurePolicy | default .Values.injector.failurePolicy }}
+    matchPolicy: {{ ((.Values.injector.webhook)).matchPolicy | default "Exact" }}
+    sideEffects: None
+    timeoutSeconds: {{ ((.Values.injector.webhook)).timeoutSeconds | default "30" }}
+    admissionReviewVersions: ["v1", "v1beta1"]
+    clientConfig:
+      service:
+        name: {{ template "vault.fullname" . }}-agent-injector-svc
+        namespace: {{ include "vault.namespace" . }}
+        path: "/mutate"
+      caBundle: {{ .Values.injector.certs.caBundle | quote }}
+    rules:
+      - operations: ["CREATE"]
+        apiGroups: [""]
+        apiVersions: ["v1"]
+        resources: ["pods"]
+        scope: "Namespaced"
+{{- if or (.Values.injector.namespaceSelector) (((.Values.injector.webhook)).namespaceSelector) }}
+    namespaceSelector:
+{{ toYaml (((.Values.injector.webhook)).namespaceSelector | default .Values.injector.namespaceSelector) | indent 6}}
+{{ end }}
+{{- template "injector.objectSelector" . -}}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-network-policy.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-network-policy.yaml
new file mode 100644
index 000000000..4c3b08782
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-network-policy.yaml
@@ -0,0 +1,29 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.openshift | toString) "true" }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector
+  labels:
+    app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: webhook
+  ingress:
+    - from:
+        - namespaceSelector: {}
+      ports:
+      - port: 8080
+        protocol: TCP
+{{ end }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp-role.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp-role.yaml
new file mode 100644
index 000000000..a07f8f6c0
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp-role.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-psp
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+    - {{ template "vault.fullname" . }}-agent-injector
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp-rolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp-rolebinding.yaml
new file mode 100644
index 000000000..3c97e8dad
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp-rolebinding.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-psp
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  kind: Role
+  name: {{ template "vault.fullname" . }}-agent-injector-psp
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "vault.fullname" . }}-agent-injector
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp.yaml
new file mode 100644
index 000000000..0eca9a87c
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-psp.yaml
@@ -0,0 +1,51 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- template "vault.psp.annotations" . }}
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  volumes:
+    - configMap
+    - emptyDir
+    - projected
+    - secret
+    - downwardAPI
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: MustRunAsNonRoot
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: RunAsAny
+  supplementalGroups:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-role.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-role.yaml
new file mode 100644
index 000000000..167f3a3bf
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-role.yaml
@@ -0,0 +1,38 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-leader-elector-role
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets", "configmaps"]
+    verbs:
+      - "create"
+      - "get"
+      - "watch"
+      - "list"
+      - "update"
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs:
+      - "delete"
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+      - "get"
+      - "patch"
+      - "delete"
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-rolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-rolebinding.yaml
new file mode 100644
index 000000000..6ad25ca69
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-rolebinding.yaml
@@ -0,0 +1,27 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-leader-elector-binding
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "vault.fullname" . }}-agent-injector-leader-elector-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "vault.fullname" . }}-agent-injector
+    namespace: {{ include "vault.namespace" . }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-service.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-service.yaml
new file mode 100644
index 000000000..1479cd1ab
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-service.yaml
@@ -0,0 +1,27 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector-svc
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{ template "injector.service.annotations" . }}
+spec:
+  ports:
+  - name: https
+    port: 443
+    targetPort: {{ .Values.injector.port }}
+  selector:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    component: webhook
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-serviceaccount.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-serviceaccount.yaml
new file mode 100644
index 000000000..2f91c3d4a
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/injector-serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "vault.fullname" . }}-agent-injector
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{ template "injector.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/prometheus-prometheusrules.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/prometheus-prometheusrules.yaml
new file mode 100644
index 000000000..7e58a0e52
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/prometheus-prometheusrules.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ if and (.Values.serverTelemetry.prometheusRules.rules)
+     (or (.Values.global.serverTelemetry.prometheusOperator) (.Values.serverTelemetry.prometheusRules.enabled) )
+}}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ template "vault.fullname" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- /* update the selectors docs in values.yaml whenever the defaults below change. */ -}}
+    {{- $selectors := .Values.serverTelemetry.prometheusRules.selectors }}
+    {{- if $selectors }}
+    {{- toYaml $selectors | nindent 4 }}
+    {{- else }}
+    release: prometheus
+    {{- end }}
+spec:
+  groups:
+  - name: {{ include "vault.fullname" . }}
+    rules:
+      {{- toYaml .Values.serverTelemetry.prometheusRules.rules | nindent 6 }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/prometheus-servicemonitor.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/prometheus-servicemonitor.yaml
new file mode 100644
index 000000000..6d2626be2
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/prometheus-servicemonitor.yaml
@@ -0,0 +1,62 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{ if or (.Values.global.serverTelemetry.prometheusOperator) (.Values.serverTelemetry.serviceMonitor.enabled) }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "vault.fullname" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- /* update the selectors docs in values.yaml whenever the defaults below change. */ -}}
+    {{- $selectors := .Values.serverTelemetry.serviceMonitor.selectors }}
+    {{- if $selectors }}
+    {{- toYaml $selectors | nindent 4 }}
+    {{- else }}
+    release: prometheus
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "vault.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      {{- if eq .mode "ha" }}
+      vault-active: "true"
+      {{- else }}
+      vault-internal: "true"
+      {{- end }}
+  endpoints:
+  - port: {{ include "vault.scheme" . }}
+    interval: {{ .Values.serverTelemetry.serviceMonitor.interval }}
+    scrapeTimeout: {{ .Values.serverTelemetry.serviceMonitor.scrapeTimeout }}
+    scheme: {{ include "vault.scheme" . | lower }}
+    path: /v1/sys/metrics
+    params:
+      format:
+      - prometheus
+    {{- with .Values.serverTelemetry.serviceMonitor.tlsConfig }}
+    tlsConfig:
+    {{- toYaml . | nindent 6 }}
+    {{- else }}
+    tlsConfig:
+      insecureSkipVerify: true
+    {{- end }}
+    {{- with .Values.serverTelemetry.serviceMonitor.authorization }}
+    authorization:
+    {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.serverTelemetry.serviceMonitor.metricRelabelings }}
+    metricRelabelings:
+    {{- toYaml . | nindent 6 }}
+    {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "vault.namespace" . }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-clusterrolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-clusterrolebinding.yaml
new file mode 100644
index 000000000..14ec838a0
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-clusterrolebinding.yaml
@@ -0,0 +1,29 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.serverAuthDelegator" . }}
+{{- if .serverAuthDelegator -}}
+{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-server-binding
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: {{ template "vault.serviceAccount.name" . }}
+  namespace: {{ include "vault.namespace" . }}
+{{ end }}
\ No newline at end of file
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-config-configmap.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-config-configmap.yaml
new file mode 100644
index 000000000..1fed2e690
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-config-configmap.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .serverEnabled -}}
+{{- if ne .mode "dev" -}}
+{{ if or (.Values.server.standalone.config) (.Values.server.ha.config) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "vault.fullname" . }}-config
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.server.includeConfigAnnotation }}
+  annotations:
+    vault.hashicorp.com/config-checksum: {{ include "vault.config" . | sha256sum }}
+{{- end }}
+data:
+  extraconfig-from-values.hcl: |-
+    {{ template "vault.config" . }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-discovery-role.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-discovery-role.yaml
new file mode 100644
index 000000000..0cbdefaff
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-discovery-role.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "vault.namespace" . }}
+  name: {{ template "vault.fullname" . }}-discovery-role
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list", "update", "patch"]
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-discovery-rolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-discovery-rolebinding.yaml
new file mode 100644
index 000000000..87b0f6170
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-discovery-rolebinding.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
+{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: RoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-discovery-rolebinding
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "vault.fullname" . }}-discovery-role
+subjects:
+- kind: ServiceAccount
+  name: {{ template "vault.serviceAccount.name" . }}
+  namespace: {{ include "vault.namespace" . }}
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-disruptionbudget.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-disruptionbudget.yaml
new file mode 100644
index 000000000..bbe9eb299
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-disruptionbudget.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" -}}
+{{- if .serverEnabled -}}
+{{- if and (eq .mode "ha") (eq (.Values.server.ha.disruptionBudget.enabled | toString) "true") -}}
+# PodDisruptionBudget to prevent degrading the server cluster through
+# voluntary cluster changes.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "vault.fullname" . }}
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  maxUnavailable: {{ template "vault.pdb.maxUnavailable" . }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "vault.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: server
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ha-active-service.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ha-active-service.yaml
new file mode 100644
index 000000000..36ea529fe
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ha-active-service.yaml
@@ -0,0 +1,64 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.active.enabled | toString) "true" }}
+# Service for active Vault pod
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "vault.fullname" . }}-active
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    vault-active: "true"
+  annotations:
+{{- template "vault.service.annotations" . }}
+{{- template "vault.service.active.annotations" . }}
+spec:
+  {{- if .Values.server.service.type}}
+  type: {{ .Values.server.service.type }}
+  {{- end}}
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.service.clusterIP }}
+  clusterIP: {{ .Values.server.service.clusterIP }}
+  {{- end }}
+  {{- include "service.externalTrafficPolicy" .Values.server.service }}
+  publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "vault.scheme" . }}
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+      {{- if and (.Values.server.service.activeNodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+      nodePort: {{ .Values.server.service.activeNodePort }}
+      {{- end }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  selector:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
+    component: server
+    vault-active: "true"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ha-standby-service.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ha-standby-service.yaml
new file mode 100644
index 000000000..9ee8767a1
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ha-standby-service.yaml
@@ -0,0 +1,63 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.standby.enabled | toString) "true" }}
+# Service for standby Vault pod
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "vault.fullname" . }}-standby
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  annotations:
+{{- template "vault.service.annotations" . }}
+{{- template "vault.service.standby.annotations" . }}
+spec:
+  {{- if .Values.server.service.type}}
+  type: {{ .Values.server.service.type }}
+  {{- end}}
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.service.clusterIP }}
+  clusterIP: {{ .Values.server.service.clusterIP }}
+  {{- end }}
+  {{- include "service.externalTrafficPolicy" .Values.server.service }}
+  publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "vault.scheme" . }}
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+      {{- if and (.Values.server.service.standbyNodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+      nodePort: {{ .Values.server.service.standbyNodePort }}
+      {{- end }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  selector:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
+    component: server
+    vault-active: "false"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-headless-service.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-headless-service.yaml
new file mode 100644
index 000000000..c0f4d3460
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-headless-service.yaml
@@ -0,0 +1,47 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+# Service for Vault cluster
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "vault.fullname" . }}-internal
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    vault-internal: "true"
+  annotations:
+{{ template "vault.service.annotations" .}}
+spec:
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  clusterIP: None
+  publishNotReadyAddresses: true
+  ports:
+    - name: "{{ include "vault.scheme" . }}"
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  selector:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    component: server
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ingress.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ingress.yaml
new file mode 100644
index 000000000..d796bae41
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-ingress.yaml
@@ -0,0 +1,69 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if not .Values.global.openshift }}
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.ingress.enabled -}}
+{{- $extraPaths := .Values.server.ingress.extraPaths -}}
+{{- $serviceName := include "vault.fullname" . -}}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.ingress.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+{{- $servicePort := .Values.server.service.port -}}
+{{- $pathType := .Values.server.ingress.pathType -}}
+{{- $kubeVersion := .Capabilities.KubeVersion.Version }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ template "vault.fullname" . }}
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.ingress.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "vault.ingress.annotations" . }}
+spec:
+{{- if .Values.server.ingress.tls }}
+  tls:
+  {{- range .Values.server.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+{{- if .Values.server.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.server.ingress.ingressClassName }}
+{{- end }}
+  rules:
+  {{- range .Values.server.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+{{ if $extraPaths }}
+{{ toYaml $extraPaths | indent 10 }}
+{{- end }}
+        {{- range (.paths | default (list "/")) }}
+          - path: {{ . }}
+            pathType: {{ $pathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}
+                port:
+                  number: {{ $servicePort }}
+        {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-network-policy.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-network-policy.yaml
new file mode 100644
index 000000000..43dcdb16f
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-network-policy.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if eq (.Values.server.networkPolicy.enabled | toString) "true"  }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "vault.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "vault.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  ingress: {{- toYaml .Values.server.networkPolicy.ingress | nindent 4 }}
+  {{- if .Values.server.networkPolicy.egress }}
+  egress:
+  {{- toYaml .Values.server.networkPolicy.egress | nindent 4 }}
+  {{ end }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp-role.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp-role.yaml
new file mode 100644
index 000000000..64cd6c507
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp-role.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "vault.fullname" . }}-psp
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+    - {{ template "vault.fullname" . }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp-rolebinding.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp-rolebinding.yaml
new file mode 100644
index 000000000..342f55379
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp-rolebinding.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "vault.fullname" . }}-psp
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  kind: Role
+  name: {{ template "vault.fullname" . }}-psp
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "vault.fullname" . }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp.yaml
new file mode 100644
index 000000000..567e66245
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-psp.yaml
@@ -0,0 +1,54 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "vault.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- template "vault.psp.annotations" . }}
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  volumes:
+    - configMap
+    - emptyDir
+    - projected
+    - secret
+    - downwardAPI
+    {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+    - persistentVolumeClaim
+    {{- end }}
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: MustRunAsNonRoot
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: RunAsAny
+  supplementalGroups:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: MustRunAs
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-route.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-route.yaml
new file mode 100644
index 000000000..4e955555a
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-route.yaml
@@ -0,0 +1,39 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if .Values.global.openshift }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.route.enabled -}}
+{{- $serviceName := include "vault.fullname" . -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.route.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: {{ template "vault.fullname" . }}
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.server.route.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- template "vault.route.annotations" . }}
+spec:
+  host: {{ .Values.server.route.host }}
+  to:
+    kind: Service
+    name: {{ $serviceName }}
+    weight: 100
+  port:
+    targetPort: 8200
+  tls:
+    {{- toYaml .Values.server.route.tls | nindent  4 }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-service.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-service.yaml
new file mode 100644
index 000000000..c12e190cb
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-service.yaml
@@ -0,0 +1,59 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+# Service for Vault cluster
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "vault.fullname" . }}
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  annotations:
+{{ template "vault.service.annotations" .}}
+spec:
+  {{- if .Values.server.service.type}}
+  type: {{ .Values.server.service.type }}
+  {{- end}}
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.server.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.server.service.ipFamilies }}
+  ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.service.clusterIP }}
+  clusterIP: {{ .Values.server.service.clusterIP }}
+  {{- end }}
+  {{- include "service.externalTrafficPolicy" .Values.server.service }}
+  # We want the servers to become available even if they're not ready
+  # since this DNS is also used for join operations.
+  publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "vault.scheme" . }}
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ .Values.server.service.targetPort }}
+      {{- if and (.Values.server.service.nodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+      nodePort: {{ .Values.server.service.nodePort }}
+      {{- end }}
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  selector:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
+    component: server
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-serviceaccount-secret.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-serviceaccount-secret.yaml
new file mode 100644
index 000000000..74d70f900
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-serviceaccount-secret.yaml
@@ -0,0 +1,21 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.serverServiceAccountSecretCreationEnabled" . }}
+{{- if .serverServiceAccountSecretCreationEnabled -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "vault.serviceAccount.name" . }}-token
+  namespace: {{ include "vault.namespace" . }}
+  annotations:
+    kubernetes.io/service-account.name: {{ template "vault.serviceAccount.name" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+type: kubernetes.io/service-account-token
+{{ end }}
\ No newline at end of file
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-serviceaccount.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-serviceaccount.yaml
new file mode 100644
index 000000000..216ea6178
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-serviceaccount.yaml
@@ -0,0 +1,22 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.serverServiceAccountEnabled" . }}
+{{- if .serverServiceAccountEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "vault.serviceAccount.name" . }}
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.server.serviceAccount.extraLabels -}}
+      {{- toYaml .Values.server.serviceAccount.extraLabels | nindent 4 -}}
+    {{- end -}}
+  {{ template "vault.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/server-statefulset.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-statefulset.yaml
new file mode 100644
index 000000000..7e5810c46
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/server-statefulset.yaml
@@ -0,0 +1,240 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if ne .mode "" }}
+{{- if .serverEnabled -}}
+# StatefulSet to run the actual vault server cluster.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ template "vault.fullname" . }}
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- template "vault.statefulSet.annotations" . }}
+spec:
+  serviceName: {{ template "vault.fullname" . }}-internal
+  podManagementPolicy: Parallel
+  replicas: {{ template "vault.replicas" . }}
+  updateStrategy:
+    type: {{ .Values.server.updateStrategyType }}
+  {{- if and (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) (.Values.server.persistentVolumeClaimRetentionPolicy) }}
+  persistentVolumeClaimRetentionPolicy: {{ toYaml .Values.server.persistentVolumeClaimRetentionPolicy | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "vault.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      component: server
+  template:
+    metadata:
+      labels:
+        helm.sh/chart: {{ template "vault.chart" . }}
+        app.kubernetes.io/name: {{ template "vault.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        component: server
+        {{- if  .Values.server.extraLabels -}}
+          {{- toYaml .Values.server.extraLabels | nindent 8 -}}
+        {{- end -}}
+      {{ template "vault.annotations" . }}
+    spec:
+      {{ template "vault.affinity" . }}
+      {{ template "vault.topologySpreadConstraints" . }}
+      {{ template "vault.tolerations" . }}
+      {{ template "vault.nodeselector" . }}
+      {{- if .Values.server.priorityClassName }}
+      priorityClassName: {{ .Values.server.priorityClassName }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.server.terminationGracePeriodSeconds }}
+      serviceAccountName: {{ template "vault.serviceAccount.name" . }}
+      {{ if  .Values.server.shareProcessNamespace }}
+      shareProcessNamespace: true
+      {{ end }}
+      {{- template "server.statefulSet.securityContext.pod" . }}
+      {{- if not .Values.global.openshift }}
+      hostNetwork: {{ .Values.server.hostNetwork }}
+      {{- end }}
+      volumes:
+        {{ template "vault.volumes" . }}
+        - name: home
+          emptyDir: {}
+      {{- if .Values.server.hostAliases }}
+      hostAliases:
+        {{ toYaml .Values.server.hostAliases | nindent 8}}
+      {{- end }}
+      {{- if .Values.server.extraInitContainers }}
+      initContainers:
+        {{ toYaml .Values.server.extraInitContainers | nindent 8}}
+      {{- end }}
+      containers:
+        - name: vault
+          {{ template "vault.resources" . }}
+          image: {{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default "latest" }}
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          command:
+          - "/bin/sh"
+          - "-ec"
+          args: {{ template "vault.args" . }}
+          {{- template "server.statefulSet.securityContext.container" . }}
+          env:
+            - name: HOST_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.hostIP
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: VAULT_K8S_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: VAULT_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: VAULT_ADDR
+              value: "{{ include "vault.scheme" . }}://127.0.0.1:8200"
+            - name: VAULT_API_ADDR
+              {{- if .Values.server.ha.apiAddr }}
+              value: {{ .Values.server.ha.apiAddr }}
+              {{- else }}
+              value: "{{ include "vault.scheme" . }}://$(POD_IP):8200"
+              {{- end }}
+            - name: SKIP_CHOWN
+              value: "true"
+            - name: SKIP_SETCAP
+              value: "true"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: VAULT_CLUSTER_ADDR
+              {{- if .Values.server.ha.clusterAddr }}
+              value: {{ .Values.server.ha.clusterAddr | quote }}
+              {{- else }}
+              value: "https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201"
+              {{- end }}
+            {{- if and (eq (.Values.server.ha.raft.enabled | toString) "true") (eq (.Values.server.ha.raft.setNodeId | toString) "true") }}
+            - name: VAULT_RAFT_NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            {{- end }}
+            - name: HOME
+              value: "/home/vault"
+            {{- if .Values.server.logLevel }}
+            - name: VAULT_LOG_LEVEL
+              value: "{{ .Values.server.logLevel }}"
+            {{- end }}
+            {{- if .Values.server.logFormat }}
+            - name: VAULT_LOG_FORMAT
+              value: "{{ .Values.server.logFormat }}"
+            {{- end }}
+            {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
+            - name: VAULT_LICENSE_PATH
+              value: /vault/license/{{ .Values.server.enterpriseLicense.secretKey }}
+            {{- end }}
+            {{ template "vault.envs" . }}
+            {{- include "vault.extraEnvironmentVars" .Values.server | nindent 12 }}
+            {{- include "vault.extraSecretEnvironmentVars" .Values.server | nindent 12 }}
+          volumeMounts:
+          {{ template "vault.mounts" . }}
+            - name: home
+              mountPath: /home/vault
+          ports:
+            - containerPort: 8200
+              name: {{ include "vault.scheme" . }}
+            - containerPort: 8201
+              name: https-internal
+            - containerPort: 8202
+              name: {{ include "vault.scheme" . }}-rep
+          {{- if .Values.server.extraPorts -}}
+          {{ toYaml .Values.server.extraPorts | nindent 12}}
+          {{- end }}
+          {{- if .Values.server.readinessProbe.enabled }}
+          readinessProbe:
+            {{- if .Values.server.readinessProbe.path }}
+            httpGet:
+              path: {{ .Values.server.readinessProbe.path | quote }}
+              port: {{ .Values.server.readinessProbe.port }}
+              scheme: {{ include "vault.scheme" . | upper }}
+            {{- else }}
+            # Check status; unsealed vault servers return 0
+            # The exit code reflects the seal status:
+            #   0 - unsealed
+            #   1 - error
+            #   2 - sealed
+            exec:
+              command: ["/bin/sh", "-ec", "vault status -tls-skip-verify"]
+            {{- end }}
+            failureThreshold: {{ .Values.server.readinessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.server.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.server.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.server.readinessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.server.readinessProbe.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.server.livenessProbe.enabled }}
+          livenessProbe:
+            {{- if .Values.server.livenessProbe.execCommand }}
+            exec:
+              command:
+                {{- range (.Values.server.livenessProbe.execCommand) }}
+                - {{ . | quote }}
+                {{- end }}
+            {{- else }}
+            httpGet:
+              path: {{ .Values.server.livenessProbe.path | quote }}
+              port: {{ .Values.server.livenessProbe.port }}
+              scheme: {{ include "vault.scheme" . | upper }}
+            {{- end }}
+            failureThreshold: {{ .Values.server.livenessProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.server.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.server.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.server.livenessProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.server.livenessProbe.timeoutSeconds }}
+          {{- end }}
+          lifecycle:
+            # Vault container doesn't receive SIGTERM from Kubernetes
+            # and after the grace period ends, Kube sends SIGKILL.  This
+            # causes issues with graceful shutdowns such as deregistering itself
+            # from Consul (zombie services).
+            preStop:
+            {{- if .Values.server.preStop }}
+              exec:
+                command:
+                {{- range (.Values.server.preStop) }}
+                - {{ . | quote }}
+                {{- end }}
+            {{- else }}
+              exec:
+                command:
+                - "/bin/sh"
+                - "-c"
+                # Adding a sleep here to give the pod eviction a
+                # chance to propagate, so requests will not be made
+                # to this pod while it's terminating
+                - "sleep {{ .Values.server.preStopSleepSeconds }} && kill -SIGTERM $(pidof vault)"
+            {{- end}}
+            {{- if .Values.server.postStart }}
+            postStart:
+              exec:
+                command:
+                {{- range (.Values.server.postStart) }}
+                - {{ . | quote }}
+                {{- end }}
+            {{- end }}
+        {{- if .Values.server.extraContainers }}
+          {{ toYaml .Values.server.extraContainers | nindent 8}}
+        {{- end }}
+      {{- include "imagePullSecrets" . | nindent 6 }}
+  {{ template "vault.volumeclaims" . }}
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/tests/server-test.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/tests/server-test.yaml
new file mode 100644
index 000000000..065415f3c
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/tests/server-test.yaml
@@ -0,0 +1,60 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .serverEnabled -}}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ template "vault.fullname" . }}-server-test
+  namespace: {{ include "vault.namespace" . }}
+  annotations:
+    "helm.sh/hook": test
+  {{- with .Values.server.extraLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- include "imagePullSecrets" . | nindent 2 }}
+  containers:
+    - name: {{ .Release.Name }}-server-test
+      image: {{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default "latest" }}
+      imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+      env:
+        - name: VAULT_ADDR
+          value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
+        {{- include "vault.extraEnvironmentVars" .Values.server | nindent 8 }}
+      command:
+        - /bin/sh
+        - -c
+        - |
+          echo "Checking for sealed info in 'vault status' output"
+          ATTEMPTS=10
+          n=0
+          until [ "$n" -ge $ATTEMPTS ]
+          do
+            echo "Attempt" $n...
+            vault status -format yaml | grep -E '^sealed: (true|false)' && break
+            n=$((n+1))
+            sleep 5
+          done
+          if [ $n -ge $ATTEMPTS ]; then
+            echo "timed out looking for sealed info in 'vault status' output"
+            exit 1
+          fi
+
+          exit 0
+      {{- if .Values.server.volumeMounts }}
+      volumeMounts:
+        {{- toYaml .Values.server.volumeMounts | nindent 8}}
+      {{- end }}
+  {{- if .Values.server.volumes }}
+  volumes:
+    {{- toYaml .Values.server.volumes | nindent 4}}
+  {{- end }}
+  restartPolicy: Never
+{{- end }}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/templates/ui-service.yaml b/charts/partners/hashicorp/vault/0.31.0/src/templates/ui-service.yaml
new file mode 100644
index 000000000..95370842e
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/templates/ui-service.yaml
@@ -0,0 +1,50 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.uiEnabled" . -}}
+{{- if .uiEnabled -}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "vault.fullname" . }}-ui
+  namespace: {{ include "vault.namespace" . }}
+  labels:
+    helm.sh/chart: {{ include "vault.chart" . }}
+    app.kubernetes.io/name: {{ include "vault.name" . }}-ui
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- template "vault.ui.annotations" . }}
+spec:
+  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if .Values.ui.serviceIPFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.ui.serviceIPFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.ui.serviceIPFamilies }}
+  ipFamilies: {{ .Values.ui.serviceIPFamilies | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
+  selector:
+    app.kubernetes.io/name: {{ include "vault.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    component: server
+    {{- if and (.Values.ui.activeVaultPodOnly) (eq .mode "ha") }}
+    vault-active: "true"
+    {{- end }}
+  publishNotReadyAddresses: {{ .Values.ui.publishNotReadyAddresses }}
+  ports:
+    - name: {{ include "vault.scheme" . }}
+      port: {{ .Values.ui.externalPort }}
+      targetPort: {{ .Values.ui.targetPort }}
+      {{- if .Values.ui.serviceNodePort }}
+      nodePort: {{ .Values.ui.serviceNodePort }}
+      {{- end }}
+  type: {{ .Values.ui.serviceType }}
+  {{- include "service.externalTrafficPolicy" .Values.ui }}
+  {{- include "service.loadBalancer" .Values.ui }}
+{{- end -}}
+{{- end }}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/values.openshift.yaml b/charts/partners/hashicorp/vault/0.31.0/src/values.openshift.yaml
new file mode 100644
index 000000000..bcf71d54f
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/values.openshift.yaml
@@ -0,0 +1,34 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# These overrides are appropriate defaults for deploying this chart on OpenShift
+
+global:
+  openshift: true
+
+injector:
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault-k8s"
+    tag: "1.7.0-ubi"
+
+  agentImage:
+    repository: "registry.connect.redhat.com/hashicorp/vault"
+    tag: "1.20.4-ubi"
+
+server:
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault"
+    tag: "1.20.4-ubi"
+
+  readinessProbe:
+    path: "/v1/sys/health?uninitcode=204"
+
+csi:
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault-csi-provider"
+    tag: "1.6.0-ubi"
+
+  agent:
+    image:
+      repository: "registry.connect.redhat.com/hashicorp/vault"
+      tag: "1.20.4-ubi"
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/values.schema.json b/charts/partners/hashicorp/vault/0.31.0/src/values.schema.json
new file mode 100644
index 000000000..934116acf
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/values.schema.json
@@ -0,0 +1,1329 @@
+{
+    "$schema": "https://json-schema.org/draft-07/schema#",
+    "type": "object",
+    "properties": {
+        "csi": {
+            "type": "object",
+            "properties": {
+                "agent": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "extraArgs": {
+                            "type": "array"
+                        },
+                        "image": {
+                            "type": "object",
+                            "properties": {
+                                "pullPolicy": {
+                                    "type": "string"
+                                },
+                                "repository": {
+                                    "type": "string"
+                                },
+                                "tag": {
+                                    "type": "string"
+                                }
+                            }
+                        },
+                        "logFormat": {
+                            "type": "string"
+                        },
+                        "logLevel": {
+                            "type": "string"
+                        },
+                        "resources": {
+                            "type": "object"
+                        },
+                        "securityContext": {
+                            "type": "object",
+                            "properties": {
+                                "container": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        }
+                    }
+                },
+                "daemonSet": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        },
+                        "kubeletRootDir": {
+                            "type": "string"
+                        },
+                        "providersDir": {
+                            "type": "string"
+                        },
+                        "securityContext": {
+                            "type": "object",
+                            "properties": {
+                                "container": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                },
+                                "pod": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        },
+                        "updateStrategy": {
+                            "type": "object",
+                            "properties": {
+                                "maxUnavailable": {
+                                    "type": "string"
+                                },
+                                "type": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                },
+                "debug": {
+                    "type": "boolean"
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "extraArgs": {
+                    "type": "array"
+                },
+                "hmacSecretName": {
+                    "type": "string"
+                },
+                "hostNetwork": {
+                    "type": "boolean"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "pullPolicy": {
+                            "type": "string"
+                        },
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "livenessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "logLevel": {
+                    "type": "string"
+                },
+                "pod": {
+                    "type": "object",
+                    "properties": {
+                        "affinity": {
+                            "type": [
+                              "null",
+                              "object",
+                              "string"
+                            ]
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        },
+                        "nodeSelector": {
+                            "type": [
+                              "null",
+                              "object",
+                              "string"
+                            ]
+                        },
+                        "tolerations": {
+                            "type": [
+                                "null",
+                                "array",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "priorityClassName": {
+                    "type": "string"
+                },
+                "readinessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "serviceAccount": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        }
+                    }
+                },
+                "volumeMounts": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "volumes": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                }
+            }
+        },
+        "global": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                },
+                "externalVaultAddr": {
+                    "type": "string"
+                },
+                "imagePullSecrets": {
+                    "type": "array"
+                },
+                "namespace": {
+                    "type": "string"
+                },
+                "openshift": {
+                    "type": "boolean"
+                },
+                "psp": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enable": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "serverTelemetry": {
+                    "type": "object",
+                    "properties": {
+                        "prometheusOperator": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "tlsDisable": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "injector": {
+            "type": "object",
+            "properties": {
+                "affinity": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "agentDefaults": {
+                    "type": "object",
+                    "properties": {
+                        "cpuLimit": {
+                            "type": "string"
+                        },
+                        "cpuRequest": {
+                            "type": "string"
+                        },
+                        "memLimit": {
+                            "type": "string"
+                        },
+                        "memRequest": {
+                            "type": "string"
+                        },
+                        "ephemeralLimit": {
+                            "type": "string"
+                        },
+                        "ephemeralRequest": {
+                            "type": "string"
+                        },
+                        "template": {
+                            "type": "string"
+                        },
+                        "templateConfig": {
+                            "type": "object",
+                            "properties": {
+                                "exitOnRetryFailure": {
+                                    "type": "boolean"
+                                },
+                                "staticSecretRenderInterval": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                },
+                "agentImage": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "annotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "authPath": {
+                    "type": "string"
+                },
+                "certs": {
+                    "type": "object",
+                    "properties": {
+                        "caBundle": {
+                            "type": "string"
+                        },
+                        "certName": {
+                            "type": "string"
+                        },
+                        "keyName": {
+                            "type": "string"
+                        },
+                        "secretName": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "externalVaultAddr": {
+                    "type": "string"
+                },
+                "extraEnvironmentVars": {
+                    "type": "object"
+                },
+                "extraLabels": {
+                    "type": "object"
+                },
+                "failurePolicy": {
+                    "type": "string"
+                },
+                "hostNetwork": {
+                    "type": "boolean"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "pullPolicy": {
+                            "type": "string"
+                        },
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "leaderElector": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "livenessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "logFormat": {
+                    "type": "string"
+                },
+                "logLevel": {
+                    "type": "string"
+                },
+                "metrics": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "namespaceSelector": {
+                    "type": "object"
+                },
+                "nodeSelector": {
+                    "type": [
+                        "null",
+                        "object",
+                        "string"
+                    ]
+                },
+                "objectSelector": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "podDisruptionBudget": {
+                    "type": "object"
+                },
+                "port": {
+                    "type": "integer"
+                },
+                "priorityClassName": {
+                    "type": "string"
+                },
+                "readinessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "replicas": {
+                    "type": "integer"
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "revokeOnShutdown": {
+                    "type": "boolean"
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "container": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "pod": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "serviceAccount": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "startupProbe": {
+                    "type": "object",
+                    "properties": {
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "strategy": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "tolerations": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "topologySpreadConstraints": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "webhook": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "failurePolicy": {
+                            "type": "string"
+                        },
+                        "matchPolicy": {
+                            "type": "string"
+                        },
+                        "namespaceSelector": {
+                            "type": "object"
+                        },
+                        "objectSelector": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "webhookAnnotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                }
+            }
+        },
+        "server": {
+            "type": "object",
+            "properties": {
+                "affinity": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "annotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "auditStorage": {
+                    "type": "object",
+                    "properties": {
+                        "accessMode": {
+                            "type": "string"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": [
+                                "boolean",
+                                "string"
+                            ]
+                        },
+                        "labels": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "mountPath": {
+                            "type": "string"
+                        },
+                        "size": {
+                            "type": "string"
+                        },
+                        "storageClass": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "authDelegator": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "dataStorage": {
+                    "type": "object",
+                    "properties": {
+                        "accessMode": {
+                            "type": "string"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": [
+                                "boolean",
+                                "string"
+                            ]
+                        },
+                        "labels": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "mountPath": {
+                            "type": "string"
+                        },
+                        "size": {
+                            "type": "string"
+                        },
+                        "storageClass": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        }
+                    }
+                },
+                "dev": {
+                    "type": "object",
+                    "properties": {
+                        "devRootToken": {
+                            "type": "string"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "enterpriseLicense": {
+                    "type": "object",
+                    "properties": {
+                        "secretKey": {
+                            "type": "string"
+                        },
+                        "secretName": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "extraArgs": {
+                    "type": "string"
+                },
+                "extraContainers": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "extraEnvironmentVars": {
+                    "type": "object"
+                },
+                "extraInitContainers": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "extraLabels": {
+                    "type": "object"
+                },
+                "extraPorts": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "extraSecretEnvironmentVars": {
+                    "type": "array"
+                },
+                "extraVolumes": {
+                    "type": "array"
+                },
+                "ha": {
+                    "type": "object",
+                    "properties": {
+                        "apiAddr": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        },
+                        "clusterAddr": {
+                            "type": [
+                                "null",
+                                "string"
+                            ]
+                        },
+                        "config": {
+                            "type": [
+                                "string",
+                                "object"
+                            ]
+                        },
+                        "disruptionBudget": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "maxUnavailable": {
+                                    "type": [
+                                        "null",
+                                        "integer"
+                                    ]
+                                }
+                            }
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "raft": {
+                            "type": "object",
+                            "properties": {
+                                "config": {
+                                    "type": [
+                                        "string",
+                                        "object"
+                                    ]
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                },
+                                "setNodeId": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
+                        "replicas": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "hostAliases": {
+                    "type": "array"
+                },
+                "hostNetwork": {
+                    "type": "boolean"
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "pullPolicy": {
+                            "type": "string"
+                        },
+                        "repository": {
+                            "type": "string"
+                        },
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "includeConfigAnnotation": {
+                    "type": "boolean"
+                },
+                "ingress": {
+                    "type": "object",
+                    "properties": {
+                        "activeService": {
+                            "type": "boolean"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "extraPaths": {
+                            "type": "array"
+                        },
+                        "hosts": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "host": {
+                                        "type": "string"
+                                    },
+                                    "paths": {
+                                        "type": "array"
+                                    }
+                                }
+                            }
+                        },
+                        "ingressClassName": {
+                            "type": "string"
+                        },
+                        "labels": {
+                            "type": "object"
+                        },
+                        "pathType": {
+                            "type": "string"
+                        },
+                        "tls": {
+                            "type": "array"
+                        }
+                    }
+                },
+                "livenessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "execCommand": {
+                            "type": "array"
+                        },
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "path": {
+                            "type": "string"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "port": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "logFormat": {
+                    "type": "string"
+                },
+                "logLevel": {
+                    "type": "string"
+                },
+                "networkPolicy": {
+                    "type": "object",
+                    "properties": {
+                        "egress": {
+                            "type": "array"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "ingress": {
+                            "type": "array"
+                        }
+                    }
+                },
+                "nodeSelector": {
+                    "type": [
+                        "null",
+                        "object",
+                        "string"
+                    ]
+                },
+                "persistentVolumeClaimRetentionPolicy": {
+                    "type": "object",
+                    "properties": {
+                        "whenDeleted": {
+                            "type": "string"
+                        },
+                        "whenScaled": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "postStart": {
+                    "type": "array"
+                },
+                "preStopSleepSeconds": {
+                    "type": "integer"
+                },
+                "priorityClassName": {
+                    "type": "string"
+                },
+                "readinessProbe": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "failureThreshold": {
+                            "type": "integer"
+                        },
+                        "initialDelaySeconds": {
+                            "type": "integer"
+                        },
+                        "periodSeconds": {
+                            "type": "integer"
+                        },
+                        "port": {
+                            "type": "integer"
+                        },
+                        "successThreshold": {
+                            "type": "integer"
+                        },
+                        "timeoutSeconds": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object"
+                },
+                "route": {
+                    "type": "object",
+                    "properties": {
+                        "activeService": {
+                            "type": "boolean"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "host": {
+                            "type": "string"
+                        },
+                        "labels": {
+                            "type": "object"
+                        },
+                        "tls": {
+                            "type": "object"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "active": {
+                            "type": "object",
+                            "properties": {
+                                "annotations": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
+                        "activeNodePort": {
+                            "type": "integer"
+                        },
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "externalTrafficPolicy": {
+                            "type": "string"
+                        },
+                        "instanceSelector": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
+                        "ipFamilies": {
+                            "type": "array"
+                        },
+                        "ipFamilyPolicy": {
+                            "type": "string"
+                        },
+                        "nodePort": {
+                            "type": "integer"
+                        },
+                        "port": {
+                            "type": "integer"
+                        },
+                        "publishNotReadyAddresses": {
+                            "type": "boolean"
+                        },
+                        "standby": {
+                            "type": "object",
+                            "properties": {
+                                "annotations": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                },
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
+                        "standbyNodePort": {
+                            "type": "integer"
+                        },
+                        "targetPort": {
+                            "type": "integer"
+                        }
+                    }
+                },
+                "serviceAccount": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "create": {
+                            "type": "boolean"
+                        },
+                        "createSecret": {
+                            "type": "boolean"
+                        },
+                        "extraLabels": {
+                            "type": "object"
+                        },
+                        "name": {
+                            "type": "string"
+                        },
+                        "serviceDiscovery": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        }
+                    }
+                },
+                "shareProcessNamespace": {
+                    "type": "boolean"
+                },
+                "standalone": {
+                    "type": "object",
+                    "properties": {
+                        "config": {
+                            "type": [
+                                "string",
+                                "object"
+                            ]
+                        },
+                        "enabled": {
+                            "type": [
+                                "string",
+                                "boolean"
+                            ]
+                        }
+                    }
+                },
+                "statefulSet": {
+                    "type": "object",
+                    "properties": {
+                        "annotations": {
+                            "type": [
+                                "object",
+                                "string"
+                            ]
+                        },
+                        "securityContext": {
+                            "type": "object",
+                            "properties": {
+                                "container": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                },
+                                "pod": {
+                                    "type": [
+                                        "object",
+                                        "string"
+                                    ]
+                                }
+                            }
+                        }
+                    }
+                },
+                "terminationGracePeriodSeconds": {
+                    "type": "integer"
+                },
+                "tolerations": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "topologySpreadConstraints": {
+                    "type": [
+                        "null",
+                        "array",
+                        "string"
+                    ]
+                },
+                "updateStrategyType": {
+                    "type": "string"
+                },
+                "volumeMounts": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                },
+                "volumes": {
+                    "type": [
+                        "null",
+                        "array"
+                    ]
+                }
+            }
+        },
+        "serverTelemetry": {
+            "type": "object",
+            "properties": {
+                "prometheusRules": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "rules": {
+                            "type": "array"
+                        },
+                        "selectors": {
+                            "type": "object"
+                        }
+                    }
+                },
+                "serviceMonitor": {
+                    "type": "object",
+                    "properties": {
+                        "authorization": {
+                            "type": "object"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "interval": {
+                            "type": "string"
+                        },
+                        "metricRelabelings": {
+                            "type": "array"
+                        },
+                        "scrapeTimeout": {
+                            "type": "string"
+                        },
+                        "selectors": {
+                            "type": "object"
+                        },
+                        "tlsConfig": {
+                            "type": "object"
+                        }
+                    }
+                }
+            }
+        },
+        "ui": {
+            "type": "object",
+            "properties": {
+                "activeVaultPodOnly": {
+                    "type": "boolean"
+                },
+                "annotations": {
+                    "type": [
+                        "object",
+                        "string"
+                    ]
+                },
+                "enabled": {
+                    "type": [
+                        "boolean",
+                        "string"
+                    ]
+                },
+                "externalPort": {
+                    "type": "integer"
+                },
+                "externalTrafficPolicy": {
+                    "type": "string"
+                },
+                "publishNotReadyAddresses": {
+                    "type": "boolean"
+                },
+                "serviceIPFamilies": {
+                    "type": "array"
+                },
+                "serviceIPFamilyPolicy": {
+                    "type": "string"
+                },
+                "serviceNodePort": {
+                    "type": [
+                        "null",
+                        "integer"
+                    ]
+                },
+                "serviceType": {
+                    "type": "string"
+                },
+                "targetPort": {
+                    "type": "integer"
+                }
+            }
+        }
+    }
+}
diff --git a/charts/partners/hashicorp/vault/0.31.0/src/values.yaml b/charts/partners/hashicorp/vault/0.31.0/src/values.yaml
new file mode 100644
index 000000000..ed01fb372
--- /dev/null
+++ b/charts/partners/hashicorp/vault/0.31.0/src/values.yaml
@@ -0,0 +1,1240 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# Available parameters and their default values for the Vault chart.
+
+global:
+  # enabled is the master enabled switch. Setting this to true or false
+  # will enable or disable all the components within this chart by default.
+  enabled: true
+  # The namespace to deploy to. Defaults to the `helm` installation namespace.
+  namespace: ""
+  # Image pull secret to use for registry authentication.
+  # Alternatively, the value may be specified as an array of strings.
+  imagePullSecrets: []
+  # imagePullSecrets:
+  #   - name: image-pull-secret
+
+  # TLS for end-to-end encrypted transport
+  tlsDisable: true
+  # External vault server address for the injector and CSI provider to use.
+  # Setting this will disable deployment of a vault server.
+  externalVaultAddr: ""
+  # If deploying to OpenShift
+  openshift: true
+  # Create PodSecurityPolicy for pods
+  psp:
+    enable: false
+    # Annotation for PodSecurityPolicy.
+    # This is a multi-line templated string map, and can also be set as YAML.
+    annotations: |
+      seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
+      apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+      seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
+      apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
+  serverTelemetry:
+    # Enable integration with the Prometheus Operator
+    # See the top level serverTelemetry section below before enabling this feature.
+    prometheusOperator: false
+injector:
+  # True if you want to enable vault agent injection.
+  # @default: global.enabled
+  enabled: "-"
+  replicas: 1
+  # Configures the port the injector should listen on
+  port: 8080
+  # If multiple replicas are specified, by default a leader will be determined
+  # so that only one injector attempts to create TLS certificates.
+  leaderElector:
+    enabled: true
+  # If true, will enable a node exporter metrics endpoint at /metrics.
+  metrics:
+    enabled: false
+  # Deprecated: Please use global.externalVaultAddr instead.
+  externalVaultAddr: ""
+  # image sets the repo and tag of the vault-k8s image to use for the injector.
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault-k8s"
+    tag: "1.7.0-ubi"
+    pullPolicy: IfNotPresent
+  # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
+  # containers.  This should be set to the official Vault image.  Vault 1.3.1+ is
+  # required.
+  agentImage:
+    repository: "registry.connect.redhat.com/hashicorp/vault"
+    tag: "1.20.4-ubi"
+  # The default values for the injected Vault Agent containers.
+  agentDefaults:
+    # For more information on configuring resources, see the K8s documentation:
+    # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+    cpuLimit: "500m"
+    cpuRequest: "250m"
+    memLimit: "128Mi"
+    memRequest: "64Mi"
+    # ephemeralLimit: "128Mi"
+    # ephemeralRequest: "64Mi"
+
+    # Default template type for secrets when no custom template is specified.
+    # Possible values include: "json" and "map".
+    template: "map"
+    # Default values within Agent's template_config stanza.
+    templateConfig:
+      exitOnRetryFailure: true
+      staticSecretRenderInterval: ""
+  # Used to define custom livenessProbe settings
+  livenessProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 2
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 5
+  # Used to define custom readinessProbe settings
+  readinessProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 2
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 5
+  # Used to define custom startupProbe settings
+  startupProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 12
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 5
+  # Mount Path of the Vault Kubernetes Auth Method.
+  authPath: "auth/kubernetes"
+  # Configures the log verbosity of the injector.
+  # Supported log levels include: trace, debug, info, warn, error
+  logLevel: "info"
+  # Configures the log format of the injector. Supported log formats: "standard", "json".
+  logFormat: "standard"
+  # Configures all Vault Agent sidecars to revoke their token when shutting down
+  revokeOnShutdown: false
+  webhook:
+    # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
+    # API Version of the WebHook.
+    # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
+    #
+    failurePolicy: Ignore
+    # matchPolicy specifies the approach to accepting changes based on the rules of
+    # the MutatingWebhookConfiguration.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
+    # for more details.
+    #
+    matchPolicy: Exact
+    # timeoutSeconds is the amount of seconds before the webhook request will be ignored
+    # or fails.
+    # If it is ignored or fails depends on the failurePolicy
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
+    # for more details.
+    #
+    timeoutSeconds: 30
+    # namespaceSelector is the selector for restricting the webhook to only
+    # specific namespaces.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
+    # for more details.
+    # Example:
+    # namespaceSelector:
+    #    matchLabels:
+    #      sidecar-injector: enabled
+    namespaceSelector: {}
+    # objectSelector is the selector for restricting the webhook to only
+    # specific labels.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+    # for more details.
+    # Example:
+    # objectSelector:
+    #    matchLabels:
+    #      vault-sidecar-injector: enabled
+    objectSelector: |
+      matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: NotIn
+        values:
+        - {{ template "vault.name" . }}-agent-injector
+    # Extra annotations to attach to the webhook
+    annotations: {}
+  # Deprecated: please use 'webhook.failurePolicy' instead
+  # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
+  # API Version of the WebHook.
+  # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
+  #
+  failurePolicy: Ignore
+  # Deprecated: please use 'webhook.namespaceSelector' instead
+  # namespaceSelector is the selector for restricting the webhook to only
+  # specific namespaces.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
+  # for more details.
+  # Example:
+  # namespaceSelector:
+  #    matchLabels:
+  #      sidecar-injector: enabled
+  namespaceSelector: {}
+  # Deprecated: please use 'webhook.objectSelector' instead
+  # objectSelector is the selector for restricting the webhook to only
+  # specific labels.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+  # for more details.
+  # Example:
+  # objectSelector:
+  #    matchLabels:
+  #      vault-sidecar-injector: enabled
+  objectSelector: {}
+  # Deprecated: please use 'webhook.annotations' instead
+  # Extra annotations to attach to the webhook
+  webhookAnnotations: {}
+  certs:
+    # secretName is the name of the secret that has the TLS certificate and
+    # private key to serve the injector webhook. If this is null, then the
+    # injector will default to its automatic management mode that will assign
+    # a service account to the injector to generate its own certificates.
+    secretName: null
+    # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
+    # that signed the TLS certificate that the webhook serves. This must be set
+    # if secretName is non-null unless an external service like cert-manager is
+    # keeping the caBundle updated.
+    caBundle: ""
+    # certName and keyName are the names of the files within the secret for
+    # the TLS cert and private key, respectively. These have reasonable
+    # defaults but can be customized if necessary.
+    certName: tls.crt
+    keyName: tls.key
+  # Security context for the pod template and the injector container
+  # The default pod securityContext is:
+  #   runAsNonRoot: true
+  #   runAsGroup: {{ .Values.injector.gid | default 1000 }}
+  #   runAsUser: {{ .Values.injector.uid | default 100 }}
+  #   fsGroup: {{ .Values.injector.gid | default 1000 }}
+  # and for container is
+  #    allowPrivilegeEscalation: false
+  #    capabilities:
+  #      drop:
+  #        - ALL
+  securityContext:
+    pod: {}
+    container: {}
+  resources: {}
+  # resources:
+  #   requests:
+  #     memory: 256Mi
+  #     cpu: 250m
+  #   limits:
+  #     memory: 256Mi
+  #     cpu: 250m
+
+  # extraEnvironmentVars is a list of extra environment variables to set in the
+  # injector deployment.
+  extraEnvironmentVars: {}
+  # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
+
+  # Affinity Settings for injector pods
+  # This can either be a multi-line string or YAML matching the PodSpec's affinity field.
+  # Commenting out or setting as empty the affinity variable, will allow
+  # deployment of multiple replicas to single node services such as Minikube.
+  affinity: |
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+              app.kubernetes.io/instance: "{{ .Release.Name }}"
+              component: webhook
+          topologyKey: kubernetes.io/hostname
+  # Topology settings for injector pods
+  # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  # This should be either a multi-line string or YAML matching the topologySpreadConstraints array
+  # in a PodSpec.
+  topologySpreadConstraints: []
+  # Toleration Settings for injector pods
+  # This should be either a multi-line string or YAML matching the Toleration array
+  # in a PodSpec.
+  tolerations: []
+  # nodeSelector labels for server pod assignment, formatted as a multi-line string or YAML map.
+  # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+  # Example:
+  # nodeSelector:
+  #   beta.kubernetes.io/arch: amd64
+  nodeSelector: {}
+  # Priority class for injector pods
+  priorityClassName: ""
+  # Extra annotations to attach to the injector pods
+  # This can either be YAML or a YAML-formatted multi-line templated string map
+  # of the annotations to apply to the injector pods
+  annotations: {}
+  # Extra labels to attach to the agent-injector
+  # This should be a YAML map of the labels to apply to the injector
+  extraLabels: {}
+  # Should the injector pods run on the host network (useful when using
+  # an alternate CNI in EKS)
+  hostNetwork: false
+  # Injector service specific config
+  service:
+    # Extra annotations to attach to the injector service
+    annotations: {}
+  # Injector serviceAccount specific config
+  serviceAccount:
+    # Extra annotations to attach to the injector serviceAccount
+    annotations: {}
+  # A disruption budget limits the number of pods of a replicated application
+  # that are down simultaneously from voluntary disruptions
+  podDisruptionBudget: {}
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+
+  # strategy for updating the deployment. This can be a multi-line string or a
+  # YAML map.
+  strategy: {}
+  # strategy: |
+  #   rollingUpdate:
+  #     maxSurge: 25%
+  #     maxUnavailable: 25%
+  #   type: RollingUpdate
+server:
+  # If true, or "-" with global.enabled true, Vault server will be installed.
+  # See vault.mode in _helpers.tpl for implementation details.
+  enabled: "-"
+  # [Enterprise Only] This value refers to a Kubernetes secret that you have
+  # created that contains your enterprise license. If you are not using an
+  # enterprise image or if you plan to introduce the license key via another
+  # route, then leave secretName blank ("") or set it to null.
+  # Requires Vault Enterprise 1.8 or later.
+  enterpriseLicense:
+    # The name of the Kubernetes secret that holds the enterprise license. The
+    # secret must be in the same namespace that Vault is installed into.
+    secretName: ""
+    # The key within the Kubernetes secret that holds the enterprise license.
+    secretKey: "license"
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault"
+    tag: "1.20.4-ubi"
+    # Overrides the default Image Pull Policy
+    pullPolicy: IfNotPresent
+  # Configure the Update Strategy Type for the StatefulSet
+  # See https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
+  updateStrategyType: "OnDelete"
+  # Configure the logging verbosity for the Vault server.
+  # Supported log levels include: trace, debug, info, warn, error
+  logLevel: ""
+  # Configure the logging format for the Vault server.
+  # Supported log formats include: standard, json
+  logFormat: ""
+  # Resource requests, limits, etc. for the server cluster placement. This
+  # should map directly to the value of the resources field for a PodSpec.
+  # By default no direct resource request is made.
+  resources: {}
+  # resources:
+  #   requests:
+  #     memory: 256Mi
+  #     cpu: 250m
+  #   limits:
+  #     memory: 256Mi
+  #     cpu: 250m
+
+  # Ingress allows ingress services to be created to allow external access
+  # from Kubernetes to access Vault pods.
+  # If deployment is on OpenShift, the following block is ignored.
+  # In order to expose the service, use the route section below
+  ingress:
+    enabled: false
+    labels: {}
+    # traffic: external
+    annotations: {}
+    # |
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+    #   or
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+
+    # Optionally use ingressClassName instead of deprecated annotation.
+    # See: https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation
+    ingressClassName: ""
+    # As of Kubernetes 1.19, all Ingress Paths must have a pathType configured. The default value below should be sufficient in most cases.
+    # See: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types for other possible values.
+    pathType: Prefix
+    # When HA mode is enabled and K8s service registration is being used,
+    # configure the ingress to point to the Vault active service.
+    activeService: true
+    hosts:
+      - host: chart-example.local
+        paths: []
+    ## Extra paths to prepend to the host configuration. This is useful when working with annotation based services.
+    extraPaths: []
+    # - path: /*
+    #   backend:
+    #     service:
+    #       name: ssl-redirect
+    #       port:
+    #         number: use-annotation
+    tls: []
+    #  - secretName: chart-example-tls
+    #    hosts:
+    #      - chart-example.local
+  # hostAliases is a list of aliases to be added to /etc/hosts. Specified as a YAML list.
+  hostAliases: []
+  # - ip: 127.0.0.1
+  #   hostnames:
+  #     - chart-example.local
+
+  # OpenShift only - create a route to expose the service
+  # By default the created route will be of type passthrough
+  route:
+    enabled: false
+    # When HA mode is enabled and K8s service registration is being used,
+    # configure the route to point to the Vault active service.
+    activeService: true
+    labels: {}
+    annotations: {}
+    host: chart-example.local
+    # tls will be passed directly to the route's TLS config, which
+    # can be used to configure other termination methods that terminate
+    # TLS at the router
+    tls:
+      termination: passthrough
+  # authDelegator enables a cluster role binding to be attached to the service
+  # account.  This cluster role binding can be used to setup Kubernetes auth
+  # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
+  authDelegator:
+    enabled: true
+  # extraInitContainers is a list of init containers. Specified as a YAML list.
+  # This is useful if you need to run a script to provision TLS certificates or
+  # write out configuration files in a dynamic way.
+  extraInitContainers: null
+  # # This example installs a plugin pulled from github into the /usr/local/libexec/vault/oauthapp folder,
+  # # which is defined in the volumes value.
+  # - name: oauthapp
+  #   image: "alpine"
+  #   command: [sh, -c]
+  #   args:
+  #     - cd /tmp &&
+  #       wget https://github.com/puppetlabs/vault-plugin-secrets-oauthapp/releases/download/v1.2.0/vault-plugin-secrets-oauthapp-v1.2.0-linux-amd64.tar.xz -O oauthapp.xz &&
+  #       tar -xf oauthapp.xz &&
+  #       mv vault-plugin-secrets-oauthapp-v1.2.0-linux-amd64 /usr/local/libexec/vault/oauthapp &&
+  #       chmod +x /usr/local/libexec/vault/oauthapp
+  #   volumeMounts:
+  #     - name: plugins
+  #       mountPath: /usr/local/libexec/vault
+
+  # extraContainers is a list of sidecar containers. Specified as a YAML list.
+  extraContainers: null
+  # shareProcessNamespace enables process namespace sharing between Vault and the extraContainers
+  # This is useful if Vault must be signaled, e.g. to send a SIGHUP for a log rotation
+  shareProcessNamespace: false
+  # extraArgs is a string containing additional Vault server arguments.
+  extraArgs: ""
+  # extraPorts is a list of extra ports. Specified as a YAML list.
+  # This is useful if you need to add additional ports to the statefulset in dynamic way.
+  extraPorts: null
+  # - containerPort: 8300
+  #   name: http-monitoring
+
+  # Used to define custom readinessProbe settings
+  readinessProbe:
+    enabled: true
+    # If you need to use a http path instead of the default exec
+    # path: /v1/sys/health?standbyok=true
+
+    # Port number on which readinessProbe will be checked.
+    port: 8200
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+    path: "/v1/sys/health?uninitcode=204"
+  # Used to enable a livenessProbe for the pods
+  livenessProbe:
+    enabled: false
+    # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
+    execCommand: []
+    # - /bin/sh
+    # - -c
+    # - /vault/userconfig/mylivenessscript/run.sh
+    # Path for the livenessProbe to use httpGet as the livenessProbe handler
+    path: "/v1/sys/health?standbyok=true"
+    # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
+    port: 8200
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 60
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+  # Optional duration in seconds the pod needs to terminate gracefully.
+  # See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
+  terminationGracePeriodSeconds: 10
+  # Used to set the sleep time during the preStop step, if custom preStop
+  # commands are not set.
+  preStopSleepSeconds: 5
+  # Used to define custom preStop exec commands to run before the pod is
+  # terminated. If not set, this will default to:
+  # preStop:
+  #   - "/bin/sh"
+  #   - "-c"
+  #   - "sleep {{ .Values.server.preStopSleepSeconds }} && kill -SIGTERM $(pidof vault)"
+  preStop: []
+  # Used to define commands to run after the pod is ready.
+  # This can be used to automate processes such as initialization
+  # or boostrapping auth methods.
+  postStart: []
+  # - /bin/sh
+  # - -c
+  # - /vault/userconfig/myscript/run.sh
+
+  # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be
+  # used to include variables required for auto-unseal.
+  extraEnvironmentVars: {}
+  # GOOGLE_REGION: global
+  # GOOGLE_PROJECT: myproject
+  # GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/myproject/myproject-creds.json
+
+  # extraSecretEnvironmentVars is a list of extra environment variables to set with the stateful set.
+  # These variables take value from existing Secret objects.
+  extraSecretEnvironmentVars: []
+  # - envName: AWS_SECRET_ACCESS_KEY
+  #   secretName: vault
+  #   secretKey: AWS_SECRET_ACCESS_KEY
+
+  # Deprecated: please use 'volumes' instead.
+  # extraVolumes is a list of extra volumes to mount. These will be exposed
+  # to Vault in the path `/vault/userconfig/<name>/`. The value below is
+  # an array of objects, examples are shown below.
+  extraVolumes: []
+  # - type: secret (or "configMap")
+  #   name: my-secret
+  #   path: null # default is `/vault/userconfig`
+
+  # volumes is a list of volumes made available to all containers. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumes: null
+  #   - name: plugins
+  #     emptyDir: {}
+
+  # volumeMounts is a list of volumeMounts for the main server container. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumeMounts: null
+  #   - mountPath: /usr/local/libexec/vault
+  #     name: plugins
+  #     readOnly: true
+
+  # Affinity Settings
+  # Commenting out or setting as empty the affinity variable, will allow
+  # deployment to single node services such as Minikube
+  # This should be either a multi-line string or YAML matching the PodSpec's affinity field.
+  affinity: |
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ template "vault.name" . }}
+              app.kubernetes.io/instance: "{{ .Release.Name }}"
+              component: server
+          topologyKey: kubernetes.io/hostname
+  # Topology settings for server pods
+  # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  # This should be either a multi-line string or YAML matching the topologySpreadConstraints array
+  # in a PodSpec.
+  topologySpreadConstraints: []
+  # Toleration Settings for server pods
+  # This should be either a multi-line string or YAML matching the Toleration array
+  # in a PodSpec.
+  tolerations: []
+  # nodeSelector labels for server pod assignment, formatted as a multi-line string or YAML map.
+  # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+  # Example:
+  # nodeSelector:
+  #   beta.kubernetes.io/arch: amd64
+  nodeSelector: {}
+  # Enables network policy for server pods
+  networkPolicy:
+    enabled: false
+    egress: []
+    # egress:
+    # - to:
+    #   - ipBlock:
+    #       cidr: 10.0.0.0/24
+    #   ports:
+    #   - protocol: TCP
+    #     port: 443
+    ingress:
+      - from:
+          - namespaceSelector: {}
+        ports:
+          - port: 8200
+            protocol: TCP
+          - port: 8201
+            protocol: TCP
+  # Priority class for server pods
+  priorityClassName: ""
+  # Extra labels to attach to the server pods
+  # This should be a YAML map of the labels to apply to the server pods
+  extraLabels: {}
+  # Extra annotations to attach to the server pods
+  # This can either be YAML or a YAML-formatted multi-line templated string map
+  # of the annotations to apply to the server pods
+  annotations: {}
+  # Add an annotation to the server configmap and the statefulset pods,
+  # vaultproject.io/config-checksum, that is a hash of the Vault configuration.
+  # This can be used together with an OnDelete deployment strategy to help
+  # identify which pods still need to be deleted during a deployment to pick up
+  # any configuration changes.
+  includeConfigAnnotation: false
+  # Enables a headless service to be used by the Vault Statefulset
+  service:
+    enabled: true
+    # Enable or disable the vault-active service, which selects Vault pods that
+    # have labeled themselves as the cluster leader with `vault-active: "true"`.
+    active:
+      enabled: true
+      # Extra annotations for the service definition. This can either be YAML or a
+      # YAML-formatted multi-line templated string map of the annotations to apply
+      # to the active service.
+      annotations: {}
+    # Enable or disable the vault-standby service, which selects Vault pods that
+    # have labeled themselves as a cluster follower with `vault-active: "false"`.
+    standby:
+      enabled: true
+      # Extra annotations for the service definition. This can either be YAML or a
+      # YAML-formatted multi-line templated string map of the annotations to apply
+      # to the standby service.
+      annotations: {}
+    # If enabled, the service selectors will include `app.kubernetes.io/instance: {{ .Release.Name }}`
+    # When disabled, services may select Vault pods not deployed from the chart.
+    # Does not affect the headless vault-internal service with `ClusterIP: None`
+    instanceSelector:
+      enabled: true
+    # clusterIP controls whether a Cluster IP address is attached to the
+    # Vault service within Kubernetes.  By default, the Vault service will
+    # be given a Cluster IP address, set to None to disable.  When disabled
+    # Kubernetes will create a "headless" service.  Headless services can be
+    # used to communicate with pods directly through DNS instead of a round-robin
+    # load balancer.
+    # clusterIP: None
+
+    # Configures the service type for the main Vault service.  Can be ClusterIP
+    # or NodePort.
+    #type: ClusterIP
+
+    # The IP family and IP families options are to set the behaviour in a dual-stack environment.
+    # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+    # should be.
+    # These are only supported for kubernetes versions >=1.23.0
+    #
+    # Configures the service's supported IP family policy, can be either:
+    #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
+    #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
+    #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
+    ipFamilyPolicy: ""
+    # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
+    # Can be IPv4 and/or IPv6.
+    ipFamilies: []
+    # Do not wait for pods to be ready before including them in the services'
+    # targets. Does not apply to the headless service, which is used for
+    # cluster-internal communication.
+    publishNotReadyAddresses: true
+    # The externalTrafficPolicy can be set to either Cluster or Local
+    # and is only valid for LoadBalancer and NodePort service types.
+    # The default value is Cluster.
+    # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
+    externalTrafficPolicy: Cluster
+    # If type is set to "NodePort", a specific nodePort value can be configured,
+    # will be random if left blank.
+    #nodePort: 30000
+
+    # When HA mode is enabled
+    # If type is set to "NodePort", a specific nodePort value can be configured,
+    # will be random if left blank.
+    #activeNodePort: 30001
+
+    # When HA mode is enabled
+    # If type is set to "NodePort", a specific nodePort value can be configured,
+    # will be random if left blank.
+    #standbyNodePort: 30002
+
+    # Port on which Vault server is listening
+    port: 8200
+    # Target port to which the service should be mapped to
+    targetPort: 8200
+    # Extra annotations for the service definition. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the service.
+    annotations: {}
+  # This configures the Vault Statefulset to create a PVC for data
+  # storage when using the file or raft backend storage engines.
+  # See https://developer.hashicorp.com/vault/docs/configuration/storage to know more
+  dataStorage:
+    enabled: true
+    # Size of the PVC created
+    size: 10Gi
+    # Location where the PVC will be mounted.
+    mountPath: "/vault/data"
+    # Name of the storage class to use.  If null it will use the
+    # configured default Storage Class.
+    storageClass: null
+    # Access Mode of the storage device being used for the PVC
+    accessMode: ReadWriteOnce
+    # Annotations to apply to the PVC
+    annotations: {}
+    # Labels to apply to the PVC
+    labels: {}
+  # Persistent Volume Claim (PVC) retention policy
+  # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention
+  # Example:
+  # persistentVolumeClaimRetentionPolicy:
+  #   whenDeleted: Retain
+  #   whenScaled: Retain
+  persistentVolumeClaimRetentionPolicy: {}
+  # This configures the Vault Statefulset to create a PVC for audit
+  # logs.  Once Vault is deployed, initialized, and unsealed, Vault must
+  # be configured to use this for audit logs.  This will be mounted to
+  # /vault/audit
+  # See https://developer.hashicorp.com/vault/docs/audit to know more
+  auditStorage:
+    enabled: false
+    # Size of the PVC created
+    size: 10Gi
+    # Location where the PVC will be mounted.
+    mountPath: "/vault/audit"
+    # Name of the storage class to use.  If null it will use the
+    # configured default Storage Class.
+    storageClass: null
+    # Access Mode of the storage device being used for the PVC
+    accessMode: ReadWriteOnce
+    # Annotations to apply to the PVC
+    annotations: {}
+    # Labels to apply to the PVC
+    labels: {}
+  # Run Vault in "dev" mode. This requires no further setup, no state management,
+  # and no initialization. This is useful for experimenting with Vault without
+  # needing to unseal, store keys, et. al. All data is lost on restart - do not
+  # use dev mode for anything other than experimenting.
+  # See https://developer.hashicorp.com/vault/docs/concepts/dev-server to know more
+  dev:
+    enabled: false
+    # Set VAULT_DEV_ROOT_TOKEN_ID value
+    devRootToken: "root"
+  # Run Vault in "standalone" mode. This is the default mode that will deploy if
+  # no arguments are given to helm. This requires a PVC for data storage to use
+  # the "file" backend.  This mode is not highly available and should not be scaled
+  # past a single replica.
+  standalone:
+    enabled: "-"
+    # config is a raw string of default configuration when using a Stateful
+    # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
+    # and store data there. This is only used when using a Replica count of 1, and
+    # using a stateful set. Supported formats are HCL and JSON.
+
+    # Note: Configuration files are stored in ConfigMaps so sensitive data
+    # such as passwords should be either mounted through extraSecretEnvironmentVars
+    # or through a Kube secret. For more information see:
+    # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
+    config: |-
+      ui = true
+
+      listener "tcp" {
+        tls_disable = 1
+        address = "[::]:8200"
+        cluster_address = "[::]:8201"
+        # Enable unauthenticated metrics access (necessary for Prometheus Operator)
+        #telemetry {
+        #  unauthenticated_metrics_access = "true"
+        #}
+      }
+      storage "file" {
+        path = "/vault/data"
+      }
+
+      # Example configuration for using auto-unseal, using Google Cloud KMS. The
+      # GKMS keys must already exist, and the cluster must have a service account
+      # that is authorized to access GCP KMS.
+      #seal "gcpckms" {
+      #   project     = "vault-helm-dev"
+      #   region      = "global"
+      #   key_ring    = "vault-helm-unseal-kr"
+      #   crypto_key  = "vault-helm-unseal-key"
+      #}
+
+      # Example configuration for enabling Prometheus metrics in your config.
+      #telemetry {
+      #  prometheus_retention_time = "30s"
+      #  disable_hostname = true
+      #}
+  # Run Vault in "HA" mode. There are no storage requirements unless the audit log
+  # persistence is required.  In HA mode Vault will configure itself to use Consul
+  # for its storage backend.  The default configuration provided will work the Consul
+  # Helm project by default.  It is possible to manually configure Vault to use a
+  # different HA backend.
+  ha:
+    enabled: false
+    replicas: 3
+    # Set the api_addr configuration for Vault HA
+    # See https://developer.hashicorp.com/vault/docs/configuration#api_addr
+    # If set to null, this will be set to the Pod IP Address
+    apiAddr: null
+    # Set the cluster_addr configuration for Vault HA
+    # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
+    # If set to null, this will be set to https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201
+    clusterAddr: null
+    # Enables Vault's integrated Raft storage.  Unlike the typical HA modes where
+    # Vault's persistence is external (such as Consul), enabling Raft mode will create
+    # persistent volumes for Vault to store data according to the configuration under server.dataStorage.
+    # The Vault cluster will coordinate leader elections and failovers internally.
+    raft:
+      # Enables Raft integrated storage
+      enabled: false
+      # Set the Node Raft ID to the name of the pod
+      setNodeId: false
+      # Note: Configuration files are stored in ConfigMaps so sensitive data
+      # such as passwords should be either mounted through extraSecretEnvironmentVars
+      # or through a Kube secret.  For more information see:
+      # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
+      # Supported formats are HCL and JSON.
+      config: |
+        ui = true
+
+        listener "tcp" {
+          tls_disable = 1
+          address = "[::]:8200"
+          cluster_address = "[::]:8201"
+          # Enable unauthenticated metrics access (necessary for Prometheus Operator)
+          #telemetry {
+          #  unauthenticated_metrics_access = "true"
+          #}
+        }
+
+        storage "raft" {
+          path = "/vault/data"
+        }
+
+        service_registration "kubernetes" {}
+    # config is a raw string of default configuration when using a Stateful
+    # deployment. Default is to use a Consul for its HA storage backend.
+    # Supported formats are HCL and JSON.
+
+    # Note: Configuration files are stored in ConfigMaps so sensitive data
+    # such as passwords should be either mounted through extraSecretEnvironmentVars
+    # or through a Kube secret. For more information see:
+    # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
+    config: |
+      ui = true
+
+      listener "tcp" {
+        tls_disable = 1
+        address = "[::]:8200"
+        cluster_address = "[::]:8201"
+      }
+      storage "consul" {
+        path = "vault"
+        address = "HOST_IP:8500"
+      }
+
+      service_registration "kubernetes" {}
+
+      # Example configuration for using auto-unseal, using Google Cloud KMS. The
+      # GKMS keys must already exist, and the cluster must have a service account
+      # that is authorized to access GCP KMS.
+      #seal "gcpckms" {
+      #   project     = "vault-helm-dev-246514"
+      #   region      = "global"
+      #   key_ring    = "vault-helm-unseal-kr"
+      #   crypto_key  = "vault-helm-unseal-key"
+      #}
+
+      # Example configuration for enabling Prometheus metrics.
+      # If you are using Prometheus Operator you can enable a ServiceMonitor resource below.
+      # You may wish to enable unauthenticated metrics in the listener block above.
+      #telemetry {
+      #  prometheus_retention_time = "30s"
+      #  disable_hostname = true
+      #}
+    # A disruption budget limits the number of pods of a replicated application
+    # that are down simultaneously from voluntary disruptions
+    disruptionBudget:
+      enabled: true
+      # maxUnavailable will default to (n/2)-1 where n is the number of
+      # replicas. If you'd like a custom value, you can specify an override here.
+      maxUnavailable: null
+  # Definition of the serviceAccount used to run Vault.
+  # These options are also used when using an external Vault server to validate
+  # Kubernetes tokens.
+  serviceAccount:
+    # Specifies whether a service account should be created
+    create: true
+    # The name of the service account to use.
+    # If not set and create is true, a name is generated using the fullname template
+    name: ""
+    # Create a Secret API object to store a non-expiring token for the service account.
+    # Prior to v1.24.0, Kubernetes used to generate this secret for each service account by default.
+    # Kubernetes now recommends using short-lived tokens from the TokenRequest API or projected volumes instead if possible.
+    # For more details, see https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets
+    # serviceAccount.create must be equal to 'true' in order to use this feature.
+    createSecret: false
+    # Extra annotations for the serviceAccount definition. This can either be
+    # YAML or a YAML-formatted multi-line templated string map of the
+    # annotations to apply to the serviceAccount.
+    annotations: {}
+    # Extra labels to attach to the serviceAccount
+    # This should be a YAML map of the labels to apply to the serviceAccount
+    extraLabels: {}
+    # Enable or disable a service account role binding with the permissions required for
+    # Vault's Kubernetes service_registration config option.
+    # See https://developer.hashicorp.com/vault/docs/configuration/service-registration/kubernetes
+    serviceDiscovery:
+      enabled: true
+  # Settings for the statefulSet used to run Vault.
+  statefulSet:
+    # Extra annotations for the statefulSet. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the statefulSet.
+    annotations: {}
+    # Set the pod and container security contexts.
+    # If not set, these will default to, and for *not* OpenShift:
+    # pod:
+    #   runAsNonRoot: true
+    #   runAsGroup: {{ .Values.server.gid | default 1000 }}
+    #   runAsUser: {{ .Values.server.uid | default 100 }}
+    #   fsGroup: {{ .Values.server.gid | default 1000 }}
+    # container:
+    #   allowPrivilegeEscalation: false
+    #
+    # If not set, these will default to, and for OpenShift:
+    # pod: {}
+    # container: {}
+    securityContext:
+      pod: {}
+      container: {}
+  # Should the server pods run on the host network
+  hostNetwork: false
+# Vault UI
+ui:
+  # True if you want to create a Service entry for the Vault UI.
+  #
+  # serviceType can be used to control the type of service created. For
+  # example, setting this to "LoadBalancer" will create an external load
+  # balancer (for supported K8S installations) to access the UI.
+  enabled: false
+  publishNotReadyAddresses: true
+  # The service should only contain selectors for active Vault pod
+  activeVaultPodOnly: false
+  serviceType: "ClusterIP"
+  serviceNodePort: null
+  externalPort: 8200
+  targetPort: 8200
+  # The IP family and IP families options are to set the behaviour in a dual-stack environment.
+  # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+  # should be.
+  # These are only supported for kubernetes versions >=1.23.0
+  #
+  # Configures the service's supported IP family, can be either:
+  #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
+  #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
+  #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
+  serviceIPFamilyPolicy: ""
+  # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well
+  # Can be IPv4 and/or IPv6.
+  serviceIPFamilies: []
+  # The externalTrafficPolicy can be set to either Cluster or Local
+  # and is only valid for LoadBalancer and NodePort service types.
+  # The default value is Cluster.
+  # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
+  externalTrafficPolicy: Cluster
+  #loadBalancerSourceRanges:
+  #   - 10.0.0.0/16
+  #   - 1.78.23.3/32
+
+  # loadBalancerIP:
+
+  # Extra annotations to attach to the ui service
+  # This can either be YAML or a YAML-formatted multi-line templated string map
+  # of the annotations to apply to the ui service
+  annotations: {}
+# secrets-store-csi-driver-provider-vault
+csi:
+  # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
+  #
+  # Requires installing the secrets-store-csi-driver separately, see:
+  # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
+  #
+  # With the driver and provider installed, you can mount Vault secrets into volumes
+  # similar to the Vault Agent injector, and you can also sync those secrets into
+  # Kubernetes secrets.
+  enabled: false
+  image:
+    repository: "registry.connect.redhat.com/hashicorp/vault-csi-provider"
+    tag: "1.6.0-ubi"
+    pullPolicy: IfNotPresent
+  # volumes is a list of volumes made available to all containers. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumes: null
+  # - name: tls
+  #   secret:
+  #     secretName: vault-tls
+
+  # volumeMounts is a list of volumeMounts for the main server container. These are rendered
+  # via toYaml rather than pre-processed like the extraVolumes value.
+  # The purpose is to make it easy to share volumes between containers.
+  volumeMounts: null
+  # - name: tls
+  #   mountPath: "/vault/tls"
+  #   readOnly: true
+
+  resources: {}
+  # resources:
+  #   requests:
+  #     cpu: 50m
+  #     memory: 128Mi
+  #   limits:
+  #     cpu: 50m
+  #     memory: 128Mi
+
+  # Override the default secret name for the CSI Provider's HMAC key used for
+  # generating secret versions.
+  hmacSecretName: ""
+  # Allow modification of the hostNetwork parameter to avoid the need of a
+  # dedicated pod ip
+  hostNetwork: false
+  # Settings for the daemonSet used to run the provider.
+  daemonSet:
+    updateStrategy:
+      type: RollingUpdate
+      maxUnavailable: ""
+    # Extra annotations for the daemonSet. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the daemonSet.
+    annotations: {}
+    # Provider host path (must match the CSI provider's path)
+    providersDir: "/var/run/secrets-store-csi-providers"
+    # Kubelet host path
+    kubeletRootDir: "/var/lib/kubelet"
+    # Extra labels to attach to the vault-csi-provider daemonSet
+    # This should be a YAML map of the labels to apply to the csi provider daemonSet
+    extraLabels: {}
+    # Security context for the pod template and container in the csi provider
+    # daemonSet. For OpenShift, the container securityContext defaults to
+    # `privileged: true`.
+    securityContext:
+      pod: {}
+      container: {}
+  pod:
+    # Extra annotations for the provider pods. This can either be YAML or a
+    # YAML-formatted multi-line templated string map of the annotations to apply
+    # to the pod.
+    annotations: {}
+    # Toleration Settings for provider pods
+    # This should be either a multi-line string or YAML matching the Toleration array
+    # in a PodSpec.
+    tolerations: []
+    # nodeSelector labels for csi pod assignment, formatted as a multi-line string or YAML map.
+    # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+    # Example:
+    # nodeSelector:
+    #   beta.kubernetes.io/arch: amd64
+    nodeSelector: {}
+    # Affinity Settings
+    # This should be either a multi-line string or YAML matching the PodSpec's affinity field.
+    affinity: {}
+    # Extra labels to attach to the vault-csi-provider pod
+    # This should be a YAML map of the labels to apply to the csi provider pod
+    extraLabels: {}
+  agent:
+    enabled: true
+    extraArgs: []
+    image:
+      repository: "registry.connect.redhat.com/hashicorp/vault"
+      tag: "1.20.4-ubi"
+      pullPolicy: IfNotPresent
+    logFormat: standard
+    logLevel: info
+    resources: {}
+    # resources:
+    #   requests:
+    #     memory: 256Mi
+    #     cpu: 250m
+    #   limits:
+    #     memory: 256Mi
+    #     cpu: 250m
+
+    # Security context for the vault agent sidecar container
+    securityContext:
+      container:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 100
+        runAsGroup: 1000
+  # Priority class for csi pods
+  priorityClassName: ""
+  serviceAccount:
+    # Extra annotations for the serviceAccount definition. This can either be
+    # YAML or a YAML-formatted multi-line templated string map of the
+    # annotations to apply to the serviceAccount.
+    annotations: {}
+    # Extra labels to attach to the vault-csi-provider serviceAccount
+    # This should be a YAML map of the labels to apply to the csi provider serviceAccount
+    extraLabels: {}
+  # Used to configure readinessProbe for the pods.
+  readinessProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+  # Used to configure livenessProbe for the pods.
+  livenessProbe:
+    # When a probe fails, Kubernetes will try failureThreshold times before giving up
+    failureThreshold: 2
+    # Number of seconds after the container has started before probe initiates
+    initialDelaySeconds: 5
+    # How often (in seconds) to perform the probe
+    periodSeconds: 5
+    # Minimum consecutive successes for the probe to be considered successful after having failed
+    successThreshold: 1
+    # Number of seconds after which the probe times out.
+    timeoutSeconds: 3
+  # Configures the log level for the Vault CSI provider.
+  # Supported log levels include: trace, debug, info, warn, error, and off
+  logLevel: "info"
+  # Deprecated, set logLevel to debug instead.
+  # If set to true, the logLevel will be set to debug.
+  debug: false
+  # Pass arbitrary additional arguments to vault-csi-provider.
+  # See https://developer.hashicorp.com/vault/docs/platform/k8s/csi/configurations#command-line-arguments
+  # for the available command line flags.
+  extraArgs: []
+# Vault is able to collect and publish various runtime metrics.
+# Enabling this feature requires setting adding `telemetry{}` stanza to
+# the Vault configuration. There are a few examples included in the `config` sections above.
+#
+# For more information see:
+# https://developer.hashicorp.com/vault/docs/configuration/telemetry
+# https://developer.hashicorp.com/vault/docs/internals/telemetry
+serverTelemetry:
+  # Enable support for the Prometheus Operator. If authorization is not set for authenticating
+  # to Vault's metrics endpoint, the following Vault server `telemetry{}` config must be included
+  # in the `listener "tcp"{}` stanza
+  #  telemetry {
+  #    unauthenticated_metrics_access = "true"
+  #  }
+  #
+  # See the `standalone.config` for a more complete example of this.
+  #
+  # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
+  #
+  # example:
+  #  telemetry {
+  #    prometheus_retention_time = "30s"
+  #    disable_hostname = true
+  #  }
+  #
+  # Configuration for monitoring the Vault server.
+  serviceMonitor:
+    # The Prometheus operator *must* be installed before enabling this feature,
+    # if not the chart will fail to install due to missing CustomResourceDefinitions
+    # provided by the operator.
+    #
+    # Instructions on how to install the Helm chart can be found here:
+    #  https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
+    # More information can be found here:
+    #  https://github.com/prometheus-operator/prometheus-operator
+    #  https://github.com/prometheus-operator/kube-prometheus
+
+    # Enable deployment of the Vault Server ServiceMonitor CustomResource.
+    enabled: false
+    # Selector labels to add to the ServiceMonitor.
+    # When empty, defaults to:
+    #  release: prometheus
+    selectors: {}
+    # Interval at which Prometheus scrapes metrics
+    interval: 30s
+    # Timeout for Prometheus scrapes
+    scrapeTimeout: 10s
+    # tlsConfig used for scraping the Vault metrics API.
+    # See API reference: https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.TLSConfig
+    # example:
+    # tlsConfig:
+    #   ca:
+    #     secret:
+    #       name: vault-metrics-client
+    #       key: ca.crt
+    tlsConfig: {}
+    # authorization used for scraping the Vault metrics API.
+    # See API reference: https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.SafeAuthorization
+    # example:
+    # authorization:
+    #   credentials:
+    #     name: vault-metrics-client
+    #     key: token
+    authorization: {}
+    # metricRelabelings configures the relabeling rules to apply to the samples before ingestion.
+    # See API reference: https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.RelabelConfig
+    # example:
+    # metricRelabelings:
+    #   - sourceLabels: [cluster]
+    #     targetLabel: vault_cluster
+    metricRelabelings: []
+  prometheusRules:
+    # The Prometheus operator *must* be installed before enabling this feature,
+    # if not the chart will fail to install due to missing CustomResourceDefinitions
+    # provided by the operator.
+
+    # Deploy the PrometheusRule custom resource for AlertManager based alerts.
+    # Requires that AlertManager is properly deployed.
+    enabled: false
+    # Selector labels to add to the PrometheusRules.
+    # When empty, defaults to:
+    #  release: prometheus
+    selectors: {}
+    # Some example rules.
+    rules: []
+    #  - alert: vault-HighResponseTime
+    #    annotations:
+    #      message: The response time of Vault is over 500ms on average over the last 5 minutes.
+    #    expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
+    #    for: 5m
+    #    labels:
+    #      severity: warning
+    #  - alert: vault-HighResponseTime
+    #    annotations:
+    #      message: The response time of Vault is over 1s on average over the last 5 minutes.
+    #    expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
+    #    for: 5m
+    #    labels:
+    #      severity: critical
diff --git a/charts/partners/i2i/i2i5gcorehelm/1.0.10/i2i5gcorehelm-1.0.10.tgz b/charts/partners/i2i/i2i5gcorehelm/1.0.10/i2i5gcorehelm-1.0.10.tgz
new file mode 100644
index 000000000..e1cf82914
Binary files /dev/null and b/charts/partners/i2i/i2i5gcorehelm/1.0.10/i2i5gcorehelm-1.0.10.tgz differ
diff --git a/charts/partners/i2i/i2i5gcorehelm/1.0.10/i2i5gcorehelm-1.0.10.tgz.prov b/charts/partners/i2i/i2i5gcorehelm/1.0.10/i2i5gcorehelm-1.0.10.tgz.prov
new file mode 100644
index 000000000..a6061a06c
--- /dev/null
+++ b/charts/partners/i2i/i2i5gcorehelm/1.0.10/i2i5gcorehelm-1.0.10.tgz.prov
@@ -0,0 +1,30 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+annotations:
+  charts.openshift.io/name: i2i-5G-Core
+apiVersion: v2
+appVersion: 1.12.0
+description: A Helm chart for Kubernetes
+icon: https://i2i-systems.com/wp-content/uploads/2020/02/i2i_logo.png
+kubeVersion: '>=1.19.0-0'
+name: i2i5gcorehelm
+type: application
+version: 1.0.10
+
+...
+files:
+  i2i5gcorehelm-1.0.10.tgz: sha256:f4455e09cf38acd0059e7fc628ffe95d09663be852ef6889675fd66d6068256e
+-----BEGIN PGP SIGNATURE-----
+
+wsDcBAEBCgAQBQJo8STHCRCr3kvRTbd93gAAoWsMAFHhG75TPIjIt+mFq5FtYXeP
+NFi/PQK+gWAFE72OrIxWyQQj7MoWdCC+jgsJ228zCSmfRrtNQQdQn5w2dwtRrtVQ
+Zm+oO5BpDpiuK+mywQedkAsrNetBpk/Kn1v7ZEOIx+zBW2VnuYMARuERdEc5MiVE
+u4l72e1jmsWTktZqNGrXlBNbKjjs8iQl0TtS51rMMJr9oUTULSSuD2H1UStwNTXp
+butwOjO1AIjDeRt2r4TrHAVfkG/RhiYjco+faOaFyrqivxkEQKXtCH3ETkujV8WA
+GcLuzqBKs6DVx4IVJIRE7p+zHthNxkp+XyDdS06A0OrLl5Tak1HHp7OA6mKNFYtx
+J6M4JQquOp2TmSO40lXFhRxJbo7xFUqEDjVxHFaQKIJE6jO1QwP67Kas5B7FG1SL
+GHbaobKJ1KsNWXU0/aSaZzePFfSu82SR825Enb0EFRI+HWRgg+E5qYXZok7509A7
+MdbQX9VhoKJASJd8WZ1Pu4tTJwRk8QrmwEOzl5r1zA==
+=/zrq
+-----END PGP SIGNATURE-----
\ No newline at end of file
diff --git a/charts/partners/i2i/i2i5gcorehelm/1.0.10/report.yaml b/charts/partners/i2i/i2i5gcorehelm/1.0.10/report.yaml
new file mode 100644
index 000000000..6185a8d50
--- /dev/null
+++ b/charts/partners/i2i/i2i5gcorehelm/1.0.10/report.yaml
@@ -0,0 +1,105 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:8601818804985081692
+        chart-uri: i2i5gcorehelm-1.0.10.tgz
+        digests:
+            chart: sha256:770364a0d25f44db37656886912ad149e1ea58ac9e5f8870b4459b8651439cc0
+            package: f4455e09cf38acd0059e7fc628ffe95d09663be852ef6889675fd66d6068256e
+            publicKey: a4d63b93381b667f62b79aee4c6db7646fbdad11fd925a85ef9d16c7c7da4623
+        lastCertifiedTimestamp: "2025-10-16T20:04:35.059465+03:00"
+        testedOpenShiftVersion: "4.18"
+        supportedOpenShiftVersions: '>=4.6'
+        webCatalogOnly: false
+    chart:
+        name: i2i5gcorehelm
+        home: ""
+        sources: []
+        version: 1.0.10
+        description: A Helm chart for Kubernetes
+        keywords: []
+        maintainers: []
+        icon: https://i2i-systems.com/wp-content/uploads/2020/02/i2i_logo.png
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 1.12.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: i2i-5G-Core
+        kubeversion: '>=1.19.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: PASS
+      reason: 'Chart is signed : Signature verification passed'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : quay.io/i2i/nssf-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/ausf-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/nrf-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/pcf-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/smf-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/udm-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/udr-app-ubi9:latest
+        Image is Red Hat certified : quay.io/i2i/upf-app-ubi8:1.12.0
+        Image is Red Hat certified : quay.io/i2i/amf-app-ubi9:latest
+        Image is Red Hat certified : registry.access.redhat.com/ubi8/ubi
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
diff --git a/charts/partners/i2i/i2i5gcorehelm/OWNERS b/charts/partners/i2i/i2i5gcorehelm/OWNERS
index d2f595251..029503c5f 100644
--- a/charts/partners/i2i/i2i5gcorehelm/OWNERS
+++ b/charts/partners/i2i/i2i5gcorehelm/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: i2i5gcorehelm
   shortDescription: Github i2i 5G Core Repository
 providerDelivery: false
-publicPgpKey: LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptUUdOQkdobjVYTUJEQURQemM0NnZjb0F1Zm85OWEwL2NuRWxUSSt4bzNJbzYvT0hXb3ZtN0pYakNaTnNHTTZPCm10M1ZHbmRLZFBHbGN1bmFjV0tGa1RnekFEQkd6WE1zb2Z0WW1STk80OE12bTl6K3NEbEtiMDVKeVFEem9CcXoKdDlUa3hiY3l2bFpmS2FrSHJDZlY2SVhUM0d4YlQzcTVGQ2RFL1djTmNZcUdDNUFNM2NCQWhDbUlmc1B3QytaYQpBVmxTRjRldjkyVTI3WDNLSHl1Yi9kRXQ4VnlwSlhIcGplWlFISjEycWoxU01Ic2NaQVVldUJFSjNmNGlsU3ExCjR1TENOcE95SmpPeTliTDVhdUpDcjdTR0t5OW1vTC9nRy9WVWhiVUlSNHNSZ2VVcElmYmJ3cnpWRXJjV1VYZGkKZm82UXU2TTY4dTFEUGswYkZCakY2OUNTQmFoeDJtRG9IeG5Qamw1SUdQeGdyY1FrWXM1OHpFYXNORjNxM0xUVgo2OHhTRkpkdGhoaWV6TXRUSERxUHBDUW5MYTBBQyt6OG5sZlQrUGFONVlSVDVjZTd4aUxYWDhvOWdLTVZDR012Ci9YeVo3TVJTQk1RSlR0U1RhWGJRTjhuVjYyL3R4bXB4MW5wa2Z2TEhsK1lXa1FBNU03bHN0bWpTZWQ2dmVRbloKT2lKKzVvcjRZWkhoSVlFQUVRRUFBYlFKYVRKcE5XZGpiM0psaVFIVUJCTUJDZ0ErRmlFRWdyN05kc0I2OWNvVAprS08vcDllNUkxenBMMlVGQW1objVYTUNHd01GQ1FQQ1p3QUZDd2tJQndJR0ZRb0pDQXNDQkJZQ0F3RUNIZ0VDCkY0QUFDZ2tRcDllNUkxenBMMlhBemd2K0o5WjQxTU1hZjBXSElsWkVQSnNFc3JGWklWOHdvNytjYVQwdjJIZUUKaGZUSms5b0w2QWdNMHpOSHJVT0xycE5wRGZtcjVPVlhGaHd0UjBncTVWdFVNZXdUeSs0dnRFWlRIWlJWcXpPNgpHSlVKbjBWOU5DK04yeDd1a21YVGN4emZQdE9ZcFZodjlpMFFlYTNkbkVGZlpkZ2IyLzlOY0YyTHkwLzNLNDczCm5PUjJwUmJiUklGMk9reUVJY3RtRkd0cU4yZWlHOWwzOEdPaUhUUVdldFV4eUdpNVZqWm1BTUloMlN6ZlFzcHQKSVpLWGhNVUdUSjRTS0FNaDlpUm05YUM4eUkrbEFON1dyRE51Vm15SFRLeXVJNkttcFBVU1ZaemdZNkZpSXduUgpyTDloYU1GM2FHMWJQYXJUK1RFV3QzMCtBQStVTmYzQ0s5K1F2MXh6R1ZoUE1mOTNYcExEZUFoVDZidkozdno1ClZJQ0RlSDZ1OTFVKzRrZjJLL3lXMk9GYUJkbnFMVjdlSWRHZ3RVdVEyR0JOenhzdU9PNHArREgxS2pOV25UQjMKUW5rMEVLL1pSYXpYb3hBc1pyQVZGZTVISlUxNDVUaGVWWnd1TytFR21hQjdQZGc1aFJ1aUt0RmdzaThrTTROYQpvZkVEUUsyelRPZU0rUlFMOEpGTllnWHp1UUdOQkdobjVYTUJEQURZWVY3RlFoNEg4TklqYWZIMTMvM2krbmVyCjZpdzNNQ3AyNkFGL0h5M0dZcnJzR3IzYk5yUEVCaGNnZ1UxOU90c0JhN2ZsNWo1d0sxVTczSTluM0xwcTYvSWIKL0ZhQVd5VEk5TS9qRUE0QXo3eXBvazE5YjVKVkZ5ODkrczRTbXppTFMxR1lTVG5BKzJhbC9VWWNXUkdGbnY2bQo1Q0NraVZyM3Z2STZXVXZMTVkxZWU0Y2hDTS94WGZzRnJOTnBMc3ZydmJOcUcydm1ycTh5LzVHUHFDNXNYWktwCmpRV3ZiY1pvVHZ5cXczTW9XWngzMnlleFVZTjdoYVYxSFZQSSt3VjBLbkRRQW40QmpvLy9yalIwWElFR0JNaU4KbkhtYStrenRPb2JWbkJ6U2FvRmVhT2tIUFBDY1BkU0I5NE5sYmRXdjRjMHRteTV5eDRRbjVYUGtsU1VMN3U2bAp6bXExbkUydjY3NmZTemRVdlJGTFJFdll2cTVvTFJTYzB4aWZ2Y3BZdGUrR0M5a3EwcjFjMzZPMFZRU2Z3cHRVClBJY29IMlMxdkNaL2REZHAva0N6eWVrdkhCYVZqVHAxR1pJeTVkbWxzQmd1VjJka3ZVWU0wUlppT1p1dzJCdksKbWR5MVdwRUEyYzdsUGE3dTlLNGxDcUxlWXlYTXZCVkRINWJybEdzQUVRRUFBWWtCdkFRWUFRb0FKaFloQklLKwp6WGJBZXZYS0U1Q2p2NmZYdVNOYzZTOWxCUUpvWitWekFoc01CUWtEd21jQUFBb0pFS2ZYdVNOYzZTOWxDdklNCkFNNlFuQmxLZFV1ZWthcCt1SmkrVTdKSHAwaUpocm9BVlN6NjlpSkxIRU5BU2ZyNzIvUlRVOGZZbFh4TUNORzQKUUdmR3htckducTFRdTlEL3JkbDd1Zm92U2g5b2FWelpzR3UzSXNKeFJzYXFZSWg5REltRUlDcis2UThaOHY2NQpkNW1VYkJ2blY2L0ZIR0RuRHc0WGZocEhwc3lSVnRWNGQyc0htamVzOHRFSlJiU3RZVkt2ZmNzV0lvS3Y0cGUvCjVUNG12RnJRRHBXZzRZcmRWWVhQNUNNTFhraHZWVWNCSytucElvcG53eVNUSTQ5c0ozZFZYQVpiMUg1bXg5N3gKWUZEemtuYkZHeXk3dSs1Zm50M3VQTzRyaUVGa3BIcFord1V0blJJbkU3VmtVd0taUklUKzJaUG5uQTQzVE40QQpNdWZMUlZNYTB0c05xZUJJQUdyeEk1Ym1pZUZUcXhMU29QLzk0ZmtvczNpTkRJeXl5a2gwSkVUejB1YU5IM1lGClYxZXRkZDQ3emZZWEtLVld1MzVoWlZLblpwQThnRUpGUlRPZ1FKQXNvQmxVUERoNElqaXNyRXlkd1dXK2FUUkEKVEF1TDhHWmJERThMMGZOZmg5SnFuYXpJaWNMNkVRbVJRSXNNaW1DTFlYTksySGRWMitjL1l2RktWYjVjYnFUUApEUT09Cj1Zek1lCi0tLS0tRU5EIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0tLS0K
+publicPgpKey: LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptUUdOQkdqeEFRVUJEQUNyZjFiUVMyQllLYzUrRzRzaEgxbHJGdVJZaElBYWpXMWNTWGFxQnBhaWRsNlNnZU9oCm40UnZ5SVh1bXJQR1FUbFNaQUhBRXlyZzVOR3ZFOWVVYnVvdE1NdzRodkZQS29keDJQMU5uT2VnTXlXcjRrWUcKTnQvME9zaW5sQjE1cjJncUxKclFtUWpHdmN0QWhCdk9uSU42R0FsMlpqVDNRYUlpRDk2MllBWlcyNFB6WWRpRgo3QU1lUXJqUzlhRnJrdVZzKzZiVklaem0rSFMwQkNIQWxNWmg3ZGZFVzdqQVZqZTZDcEUvTkxVdzlkMzVVOElKCjhhalVJZmR3OE1KL2ViajdreFhOSW8rT085emY4WlQrQ3FqQzZ5eklCTUJ6YWxMaFhKaEdVRDRYZ09Hb2orOEMKRmhUalZoNngvU2xWQ0EyRjllend3NGd6c1FQZGtyWFd5S0I2K3dyU2hQRWlYTi96VUE0YlY1L2o4MFlMM1ZFVgp2RTEybm1Tc29jSUs5VjJPSDhJNjhPOSs3blg2ZmMyT3E3YmV6SHZxbVJDdzlVbnhNaXMvcmVpRnkxMzQ2WnFOCnBOSHFDTG51cm5aamUwOUVlbHFwTmNKOWVQdFBTajUyQW1aZHVUcElscEtkeWYvQmRlM2FDT2lTSVJOVVdHUXAKdTc1c25QN3RmcnV1WjNFQUVRRUFBYlFoYUdGellXNGdQR2hoYzJGdWEyOXpaVUJwTW1rdGMzbHpkR1Z0Y3k1agpiMjAraVFIVUJCTUJDZ0ErRmlFRWZBb3FMa0psMjBWbE8rbFRxOTVMMFUyM2ZkNEZBbWp4QVFVQ0d3TUZDUVBDClp3QUZDd2tJQndJR0ZRb0pDQXNDQkJZQ0F3RUNIZ0VDRjRBQUNna1FxOTVMMFUyM2ZkNnFJUXdBb0FVYWc4UncKUytacy85TXlYcUU1clpGT2lUcFFPSVp6c1hDUy9GSU80R29UeENqWjYwcCtaMmgxWnlmTVdmSWlzN1ZpS0lxYwp4ZkFZNVU1NytEOVExZG91NTY0ZjN5SytVdk5ZUG9KUExNNkZaZSszaWVmbTZjekxwdXJVOFlSNzRsc1RMMFNrCmw2M3NJZE5maEt4SHhEdllLWXV1SDVyekpsKzk4NUU1T2RNbjVCSEtlMDlyZGFSQWVFVGovaGw2T0M5RGJBMUMKcjJSQzQ1VVhucERhQUR2dUFMTCtNNmpFOWRwbTYrakhJbW9xZW94Y0o0NVJYMU91aVUza2o4QWY2Qzhqak5lZgphYjJaME1aV0dMUXV6a0J3OUVWdE5DR3Z4WmdkYnBGMVRmdnUvYXg5b1RoUmxiUDZqOXZPbUkrbHEraTVsUFV1Ckduais5UTBxZS9qU3oyeXNaMy9FdXpySlZRMnRpd3gzWW1hbG1vL3crSDJFYldsdlAzT2QwcEpJOUcyODI3Z28KdUMzVkxXVG9uVHhsN0NlZGVzSlUwb0dYTzNoOFJNUDdRRkRwMzFMdDdaWFVWWFNvMGFlK1dneVlYakVRQ2h3RgpVL29Ta0xGL1VDRzQ2R2NZbXRxWHdHYnZOTCtIcVY3UUdGSXdDZXhNL09wUi9KVlRKcTN5OUpFNXVRR05CR2p4CkFRVUJEQURrOUtWUFJFbjB1bElqQzdQdG8wN2ZkN1R3RUJnSDYrSjVSZjdPWUdKZk9BY3pPc3RHaXY2QitvTW8KZ1Jab0pNai9xYTRacUJTVTBKcXhZSVhuVmNhNFZCTG9xbmtpZmk0ZjE0b0c3NHYvdU9qK3lkRkFRWXdYVUZJUAp3a0phWXI3UWJKOWZlT0QyWGF4aGNnZ2FERXJ0V25lNTRGYjZRM2syeTlYbVNBU290eXY3cVVBaE92bHpnZUJqCjJRTFo4dnNISTJkOWRmcEU5dFJNbFMyaDhya3NPTEE3N1g1R3QrZU9BZGVSbTZSdjkwNlVORm1VQjVYSlZwcm0KRlEyY2J1Sld5ZGJMVzBZVElzLy93d2NjMVFkMEhMKzQyUE9HSnppSU1Oa1hQSm43NWZZY1dBeUd1OVJ5d21RZgpycTZVZStpcDhDT3VGZE1Jc09RR01KQ01pYkZqQnJ4UmdFSTJjei92S2YzcGs4SUpVYW8rdGJRcEZoMjlYZ3UzCmNRNWxvMCtxdUt4UUdJYnd1aHh4d1BUR3ZvQ1dzTG1BK2xGdE5nRVJvcFJWdW9PeU05Slo4a3h2Y3Z2K0Z2cjEKdVIzTzdXSmVYRzU0MloyNE0vWDJicVNNUzlzWk5zaGJIK1p5TUlVUiswV3U4Y204c1B1N0Z6QjZWTm9BbTFJYQp5T1F5SWtzQUVRRUFBWWtCdkFRWUFRb0FKaFloQkh3S0tpNUNaZHRGWlR2cFU2dmVTOUZOdDMzZUJRSm84UUVGCkFoc01CUWtEd21jQUFBb0pFS3ZlUzlGTnQzM2VKK2dMLzFGSy9XWmRoN1RRaEhDL1djSGt0RjdFWm9meEJESlQKRXZ3c2NmTDFVWGNEaGJpMUFoa1VZM3UvTHBTOHdRZXZIZ2JxKzRPdEtFZ3Y4MG03YkVsVHR5N2Z6blRGcGlNWgpQTnRXSVV4OFBZNEw3UzVmZXNCNDdUd09uVUtFZVkxZy96NHZVeWJiWlI5dlViSk52eHk0Vng3aGJJbTN5RWtJCmZ4U2VaeHY2WWpEalNIaFNzRk5zQ21qK2pOaStJbXdaaWRna0JIOXJoVVZJSEo5TGtnc0xzay9LSGkvc3RZYncKaDJCajVDNzJ4Y3hteTRKVmdqVXNvU3pRVkdQaG1SMnB5cUV1RDlmeXp3c1ZtcXRkYVhCcWduMGVoVDFJdGVibQpIUDVncThLMEpkSVZobk5wNVg0YUJqWlJuVnlzWUFwTU1VSGQ4RFZYcnhOV1NMSXZMa1FjcmpYS3BNVTlMK2ViCnpOejRYR2FMc1loZW1BRDROSkxVUGxlanUrQXp0RVloVDJTRk1SZHhtMkIzaVRyYlVlVHIwY1hEakdnMExhVlAKRHhZcU9rMGF4ejBUdWx6SXRmZ2c0QlI1ZWRFS01QNGk5aUhDc2l5RmlCUE9PWURJd0dPRkdjSzZzazBibTZUKwpyeFgvTWdOUjB4ZEdQaHRFZUx3cG4reWgxVjcyWGlEd0lBPT0KPUJvbXEKLS0tLS1FTkQgUEdQIFBVQkxJQyBLRVkgQkxPQ0stLS0tLQo=
 users:
 - githubUsername: hasankose86
 vendor:
diff --git a/charts/partners/ibm-edge/demo-helm/OWNERS b/charts/partners/ibm-edge/demo-helm/OWNERS
index e900bf105..23eeefff4 100644
--- a/charts/partners/ibm-edge/demo-helm/OWNERS
+++ b/charts/partners/ibm-edge/demo-helm/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: demo-helm
   shortDescription: test
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: rhm-samples
 - githubUsername: demo123
diff --git a/charts/partners/ibm-edge/nodered-chart/OWNERS b/charts/partners/ibm-edge/nodered-chart/OWNERS
index d77d42253..053446cfc 100644
--- a/charts/partners/ibm-edge/nodered-chart/OWNERS
+++ b/charts/partners/ibm-edge/nodered-chart/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: nodered-chart
   shortDescription: Node-RED is a flow-based programming tool.
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: rhm-samples
 - githubUsername: prajyotnarulkar25
diff --git a/charts/partners/ibm/ibm-b2bi-prod/OWNERS b/charts/partners/ibm/ibm-b2bi-prod/OWNERS
index 84e92aad3..32ff210d6 100644
--- a/charts/partners/ibm/ibm-b2bi-prod/OWNERS
+++ b/charts/partners/ibm/ibm-b2bi-prod/OWNERS
@@ -1,10 +1,11 @@
 chart:
   name: ibm-b2bi-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: nikeshmi
 - githubUsername: imdad000
 vendor:
   label: ibm
-  name: IBM Japan, Ltd.
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-connect-direct/OWNERS b/charts/partners/ibm/ibm-connect-direct/OWNERS
index 425257641..c5bcf96b8 100644
--- a/charts/partners/ibm/ibm-connect-direct/OWNERS
+++ b/charts/partners/ibm/ibm-connect-direct/OWNERS
@@ -1,8 +1,9 @@
 chart:
   name: ibm-connect-direct
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
   label: ibm
-  name: IBM
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-object-storage-plugin/OWNERS b/charts/partners/ibm/ibm-object-storage-plugin/OWNERS
index cd8fad3f1..05456c70b 100644
--- a/charts/partners/ibm/ibm-object-storage-plugin/OWNERS
+++ b/charts/partners/ibm/ibm-object-storage-plugin/OWNERS
@@ -1,11 +1,12 @@
 chart:
   name: ibm-object-storage-plugin
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: ambiknai
 - githubUsername: nkkashyap
 - githubUsername: Bhagyashreek8
 vendor:
   label: ibm
-  name: IBM
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-oms-ent-prod/OWNERS b/charts/partners/ibm/ibm-oms-ent-prod/OWNERS
index 4e484a979..96b4a6fc5 100644
--- a/charts/partners/ibm/ibm-oms-ent-prod/OWNERS
+++ b/charts/partners/ibm/ibm-oms-ent-prod/OWNERS
@@ -1,9 +1,10 @@
 chart:
   name: ibm-oms-ent-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: ntinvo
 vendor:
   label: ibm
-  name: IBM
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-oms-pro-prod/OWNERS b/charts/partners/ibm/ibm-oms-pro-prod/OWNERS
index e1e6d20ae..c8c87845b 100644
--- a/charts/partners/ibm/ibm-oms-pro-prod/OWNERS
+++ b/charts/partners/ibm/ibm-oms-pro-prod/OWNERS
@@ -1,9 +1,10 @@
 chart:
   name: ibm-oms-pro-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: ntinvo
 vendor:
   label: ibm
-  name: IBM
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-operator-catalog-enablement/OWNERS b/charts/partners/ibm/ibm-operator-catalog-enablement/OWNERS
index 564506b83..d76e6c39e 100644
--- a/charts/partners/ibm/ibm-operator-catalog-enablement/OWNERS
+++ b/charts/partners/ibm/ibm-operator-catalog-enablement/OWNERS
@@ -1,10 +1,11 @@
 chart:
   name: ibm-operator-catalog-enablement
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: morstad
 - githubUsername: rondamus
 vendor:
   label: ibm
-  name: IBM
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-sfg-prod/OWNERS b/charts/partners/ibm/ibm-sfg-prod/OWNERS
index d9273f781..793318e2b 100644
--- a/charts/partners/ibm/ibm-sfg-prod/OWNERS
+++ b/charts/partners/ibm/ibm-sfg-prod/OWNERS
@@ -1,10 +1,11 @@
 chart:
   name: ibm-sfg-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: nikeshmi
 - githubUsername: imdad000
 vendor:
   label: ibm
-  name: IBM Japan, Ltd.
+  name: IBM Corporation
diff --git a/charts/partners/ibm/ibm-spectrum-protect-plus-prod/OWNERS b/charts/partners/ibm/ibm-spectrum-protect-plus-prod/OWNERS
index 26ef9d8d2..722596fe8 100644
--- a/charts/partners/ibm/ibm-spectrum-protect-plus-prod/OWNERS
+++ b/charts/partners/ibm/ibm-spectrum-protect-plus-prod/OWNERS
@@ -1,9 +1,10 @@
 chart:
   name: ibm-spectrum-protect-plus-prod
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: emcollin
 vendor:
   label: ibm
-  name: IBM
+  name: IBM Corporation
diff --git a/charts/partners/illumio/illumio/OWNERS b/charts/partners/illumio/illumio/OWNERS
index a93eb33e1..d2086ddf8 100644
--- a/charts/partners/illumio/illumio/OWNERS
+++ b/charts/partners/illumio/illumio/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: illumio
-  shortDescription: null
-publicPgpKey: null
-providerDelivery: True
+  shortDescription: unknown
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: jan-lucansky
 vendor:
diff --git a/charts/partners/inaccel/fpga-operator/OWNERS b/charts/partners/inaccel/fpga-operator/OWNERS
index b7a43eb40..215909f50 100644
--- a/charts/partners/inaccel/fpga-operator/OWNERS
+++ b/charts/partners/inaccel/fpga-operator/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: fpga-operator
   shortDescription: Simplifying FPGA management in Kubernetes
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: eliaskoromilas
 vendor:
diff --git a/charts/partners/intracom-telecom/nfvri-chart/OWNERS b/charts/partners/intracom-telecom/nfvri-chart/OWNERS
index 8b6af6e0b..fc327e011 100644
--- a/charts/partners/intracom-telecom/nfvri-chart/OWNERS
+++ b/charts/partners/intracom-telecom/nfvri-chart/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: nfvri-chart
   shortDescription: NFV-RI (TM) Helm Chart Repository
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: angelouev
 - githubUsername: danielchristod
diff --git a/charts/partners/intracom-telecom/nfvri/OWNERS b/charts/partners/intracom-telecom/nfvri/OWNERS
index 64a638543..bb7e0c1fb 100644
--- a/charts/partners/intracom-telecom/nfvri/OWNERS
+++ b/charts/partners/intracom-telecom/nfvri/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: nfvri
   shortDescription: NFV-RI (TM) Helm Chart Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: angelouev
 - githubUsername: vaspapts
diff --git a/charts/partners/iomesh/iomesh-csidriver/OWNERS b/charts/partners/iomesh/iomesh-csidriver/OWNERS
index e3c691b04..6b3565d86 100644
--- a/charts/partners/iomesh/iomesh-csidriver/OWNERS
+++ b/charts/partners/iomesh/iomesh-csidriver/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: iomesh-csidriver
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/iomesh/iomesh-operator/OWNERS b/charts/partners/iomesh/iomesh-operator/OWNERS
index 1242aa407..96e8c441c 100644
--- a/charts/partners/iomesh/iomesh-operator/OWNERS
+++ b/charts/partners/iomesh/iomesh-operator/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: iomesh-operator
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/kovair/kovairdevops-helm/OWNERS b/charts/partners/kovair/kovairdevops-helm/OWNERS
index 28a55034d..28db6b3bb 100644
--- a/charts/partners/kovair/kovairdevops-helm/OWNERS
+++ b/charts/partners/kovair/kovairdevops-helm/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: kovairdevops-helm
   shortDescription: Kovair DevOps Application Frontend Container
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: saaj562
 vendor:
diff --git a/charts/partners/lacework/lacework-agent/OWNERS b/charts/partners/lacework/lacework-agent/OWNERS
index 2650ba305..500a9a740 100644
--- a/charts/partners/lacework/lacework-agent/OWNERS
+++ b/charts/partners/lacework/lacework-agent/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: lacework-agent
   shortDescription: Lacework Agent Helm Charts
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: cirego
 - githubUsername: nschmeller
diff --git a/charts/partners/mavenir/amf/OWNERS b/charts/partners/mavenir/amf/OWNERS
index 5221e97e4..7c4588dd1 100644
--- a/charts/partners/mavenir/amf/OWNERS
+++ b/charts/partners/mavenir/amf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: amf
   shortDescription: Mavenir 5GCore AMF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/ausf/OWNERS b/charts/partners/mavenir/ausf/OWNERS
index b8d982a51..c2f5ee6af 100644
--- a/charts/partners/mavenir/ausf/OWNERS
+++ b/charts/partners/mavenir/ausf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: ausf
   shortDescription: Mavenir 5GCore AUSF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/ksync/OWNERS b/charts/partners/mavenir/ksync/OWNERS
index 1f369a877..50b6883b2 100644
--- a/charts/partners/mavenir/ksync/OWNERS
+++ b/charts/partners/mavenir/ksync/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: ksync
   shortDescription: Mavenir 5GCore KSYNC CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/mtcil/OWNERS b/charts/partners/mavenir/mtcil/OWNERS
index fdbad40c4..84994ef54 100644
--- a/charts/partners/mavenir/mtcil/OWNERS
+++ b/charts/partners/mavenir/mtcil/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: mtcil
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: shantanushivanekar123
 vendor:
diff --git a/charts/partners/mavenir/nrf/OWNERS b/charts/partners/mavenir/nrf/OWNERS
index 8ff97f508..511950c83 100644
--- a/charts/partners/mavenir/nrf/OWNERS
+++ b/charts/partners/mavenir/nrf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: nrf
   shortDescription: Mavenir 5GCore NRF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/nssf/OWNERS b/charts/partners/mavenir/nssf/OWNERS
index 670534cde..133da58c9 100644
--- a/charts/partners/mavenir/nssf/OWNERS
+++ b/charts/partners/mavenir/nssf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: nssf
   shortDescription: Mavenir 5GCore NSSF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/pcf/OWNERS b/charts/partners/mavenir/pcf/OWNERS
index 2f8bf75a7..712a3714b 100644
--- a/charts/partners/mavenir/pcf/OWNERS
+++ b/charts/partners/mavenir/pcf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: pcf
   shortDescription: Mavenir 5GCore PCF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/smf/OWNERS b/charts/partners/mavenir/smf/OWNERS
index 614f97a52..c11acb19f 100644
--- a/charts/partners/mavenir/smf/OWNERS
+++ b/charts/partners/mavenir/smf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: smf
   shortDescription: Mavenir 5GCore SMF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/udm/OWNERS b/charts/partners/mavenir/udm/OWNERS
index 280e8af27..d79f1f9b0 100644
--- a/charts/partners/mavenir/udm/OWNERS
+++ b/charts/partners/mavenir/udm/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: udm
   shortDescription: Mavenir 5GCore UDM CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/udr/OWNERS b/charts/partners/mavenir/udr/OWNERS
index d61bb6113..0aa427bd4 100644
--- a/charts/partners/mavenir/udr/OWNERS
+++ b/charts/partners/mavenir/udr/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: udr
   shortDescription: Mavenir 5GCore UDR CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/udsf/OWNERS b/charts/partners/mavenir/udsf/OWNERS
index b4e177dd5..8af81f1e4 100644
--- a/charts/partners/mavenir/udsf/OWNERS
+++ b/charts/partners/mavenir/udsf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: udsf
   shortDescription: Mavenir 5GCore UDSF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/mavenir/upf/OWNERS b/charts/partners/mavenir/upf/OWNERS
index a6c36695b..9c156dcc0 100644
--- a/charts/partners/mavenir/upf/OWNERS
+++ b/charts/partners/mavenir/upf/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: upf
   shortDescription: Mavenir 5GCore UPF CNF Helm charts
-publicPgpKey: null
-providerDelivery: True
+providerDelivery: true
+publicPgpKey: unknown
 users:
 - githubUsername: k-anirwan
 vendor:
diff --git a/charts/partners/memverge/mmai/1.0.0/report.yaml b/charts/partners/memverge/mmai/1.0.0/report.yaml
new file mode 100644
index 000000000..6e9a4d7a9
--- /dev/null
+++ b/charts/partners/memverge/mmai/1.0.0/report.yaml
@@ -0,0 +1,100 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:12547936785746172580
+        chart-uri: N/A
+        digests:
+            chart: sha256:f167f8c990d85170a6f63bafedaf3088af40d0015810d869636328a9f1c4859b
+            package: c3ea09fcf8a83dbde191a4b91ed2485af503186fb77973e5cd53b85855bc99a7
+        lastCertifiedTimestamp: "2025-10-06T23:07:38.831763+00:00"
+        testedOpenShiftVersion: "4.18"
+        supportedOpenShiftVersions: '>=4.16'
+        webCatalogOnly: true
+    chart:
+        name: mmai
+        home: ""
+        sources: []
+        version: 1.0.0
+        description: Memory Machine AI (MMAI) Management Plane
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: v1.0.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: mmai
+        kubeversion: '>= 1.29.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : ghcr.io/memverge/k8s-cli:v0.1.0
+        Image is Red Hat certified : ghcr.io/memverge/mmai-billing:v1.0.0
+        Image is Red Hat certified : ghcr.io/memverge/mysql:v8.0-1
+        Image is Red Hat certified : ghcr.io/memverge/mmai:v1.0.0
+        Image is Red Hat certified : registry.access.redhat.com/ubi9/python-312:9.5
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+
diff --git a/charts/partners/memverge/mmai/OWNERS b/charts/partners/memverge/mmai/OWNERS
new file mode 100644
index 000000000..44aa13bb0
--- /dev/null
+++ b/charts/partners/memverge/mmai/OWNERS
@@ -0,0 +1,11 @@
+chart:
+  name: mmai
+  shortDescription: Helm Chart of MMAI GPU Cluster Manager
+providerDelivery: true
+publicPgpKey: unknown
+users:
+- githubUsername: memverge-build
+- githubUsername: xiongzubiao
+vendor:
+  label: memverge
+  name: MemVerge
diff --git a/charts/partners/memverge/mvtco/1.1.0/report.yaml b/charts/partners/memverge/mvtco/1.1.0/report.yaml
new file mode 100644
index 000000000..3328e420d
--- /dev/null
+++ b/charts/partners/memverge/mvtco/1.1.0/report.yaml
@@ -0,0 +1,101 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:3376497185880928119
+        chart-uri: N/A
+        digests:
+            chart: sha256:3f9519b2b05c26121defa6a92d3dcd25de7d180b3f5af3eed7a6eaa2f275cffe
+            package: 50ac4cddbbf09fc5c0f703c82841d90dd08ec7dd89de804275c28f959fce491a
+        lastCertifiedTimestamp: "2025-09-29T20:38:49.509637+00:00"
+        testedOpenShiftVersion: "4.18"
+        supportedOpenShiftVersions: '>=4.18'
+        webCatalogOnly: true
+    chart:
+        name: mvtco
+        home: ""
+        sources: []
+        version: 1.1.0
+        description: Install MemVerge Transparent Checkpoint Operator
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: v1.1.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: mvtco
+        kubeversion: '>= 1.31.0-0'
+        dependencies:
+            - name: loki-stack
+              version: 2.10.2
+              repository: https://grafana.github.io/helm-charts
+              condition: loki-stack.enabled
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : ghcr.io/memverge/mvtco:v1.1.0
+        Image is Red Hat certified : ghcr.io/memverge/k8s-cli:v0.1.0
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+
diff --git a/charts/partners/mobileum/alerter/OWNERS b/charts/partners/mobileum/alerter/OWNERS
index bd91f915b..2d482af12 100644
--- a/charts/partners/mobileum/alerter/OWNERS
+++ b/charts/partners/mobileum/alerter/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: alerter
   shortDescription: Mobileum Private Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/caddy015/OWNERS b/charts/partners/mobileum/caddy015/OWNERS
index 76a2dfc58..26ce5b8da 100644
--- a/charts/partners/mobileum/caddy015/OWNERS
+++ b/charts/partners/mobileum/caddy015/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: caddy015
   shortDescription: Mobileum Private Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/data-sync/OWNERS b/charts/partners/mobileum/data-sync/OWNERS
index 472dc2195..8fda43a20 100644
--- a/charts/partners/mobileum/data-sync/OWNERS
+++ b/charts/partners/mobileum/data-sync/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: data-sync
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/ignite/OWNERS b/charts/partners/mobileum/ignite/OWNERS
index 6599407cb..bd03afa0a 100644
--- a/charts/partners/mobileum/ignite/OWNERS
+++ b/charts/partners/mobileum/ignite/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: ignite
   shortDescription: Mobileum Private Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/keycloak040/OWNERS b/charts/partners/mobileum/keycloak040/OWNERS
index 0fd706e9b..f4134aa2d 100644
--- a/charts/partners/mobileum/keycloak040/OWNERS
+++ b/charts/partners/mobileum/keycloak040/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: keycloak040
   shortDescription: Mobileum Private Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/sparkjobmanager/OWNERS b/charts/partners/mobileum/sparkjobmanager/OWNERS
index 244ed8284..34d09bdac 100644
--- a/charts/partners/mobileum/sparkjobmanager/OWNERS
+++ b/charts/partners/mobileum/sparkjobmanager/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: sparkjobmanager
   shortDescription: Mobileum Private Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/trinodb/OWNERS b/charts/partners/mobileum/trinodb/OWNERS
index e848a57c1..6c30246f9 100644
--- a/charts/partners/mobileum/trinodb/OWNERS
+++ b/charts/partners/mobileum/trinodb/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: trinodb
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/mobileum/wafplatform/OWNERS b/charts/partners/mobileum/wafplatform/OWNERS
index 2550b717d..f4654f98f 100644
--- a/charts/partners/mobileum/wafplatform/OWNERS
+++ b/charts/partners/mobileum/wafplatform/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: wafplatform
   shortDescription: Mobileum Private Repository
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: mobaipws
 vendor:
diff --git a/charts/partners/multipolar/bpjstk-service/OWNERS b/charts/partners/multipolar/bpjstk-service/OWNERS
index 6cd78e658..7e330607c 100644
--- a/charts/partners/multipolar/bpjstk-service/OWNERS
+++ b/charts/partners/multipolar/bpjstk-service/OWNERS
@@ -7,4 +7,4 @@ users:
 - githubUsername: andrianrf
 vendor:
   label: multipolar
-  name: PT. Multipolar Tbk
+  name: PT. Multipolar Technology Tbk
diff --git a/charts/partners/nebulon/nebulon-csi-nebulon/OWNERS b/charts/partners/nebulon/nebulon-csi-nebulon/OWNERS
index 1ecb24e18..2a02da3cc 100644
--- a/charts/partners/nebulon/nebulon-csi-nebulon/OWNERS
+++ b/charts/partners/nebulon/nebulon-csi-nebulon/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: nebulon-csi-nebulon
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: priyanka@nebulon.com
 vendor:
diff --git a/charts/partners/nirmata/kyverno/OWNERS b/charts/partners/nirmata/kyverno/OWNERS
index a07ff238a..f8445a106 100644
--- a/charts/partners/nirmata/kyverno/OWNERS
+++ b/charts/partners/nirmata/kyverno/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: kyverno
   shortDescription: Kyverno is a Kubernetes Native Policy Management engine.
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: realshuting
 - githubUsername: patelrit
diff --git a/charts/partners/nokia/cmm-operator-k8s/25.7.0-p1/report.yaml b/charts/partners/nokia/cmm-operator-k8s/25.7.0-p1/report.yaml
new file mode 100644
index 000000000..5371a14cf
--- /dev/null
+++ b/charts/partners/nokia/cmm-operator-k8s/25.7.0-p1/report.yaml
@@ -0,0 +1,98 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:2383097837922272243
+        chart-uri: N/A
+        digests:
+            chart: sha256:e50e1fb27a3c35c13a260e6d74987b2c58b661f31f25ac134fbb435c4850d922
+            package: 0dc4f5899003ce77b19ed2ae4bb98b317671900e5f9499e6bd1df33577f9e758
+        lastCertifiedTimestamp: "2025-09-16T06:18:26.594634+00:00"
+        testedOpenShiftVersion: "4.18"
+        supportedOpenShiftVersions: '>=4.7'
+        webCatalogOnly: true
+    chart:
+        name: cmm-operator-k8s
+        home: ""
+        sources: []
+        version: 25.7.0-p1
+        description: A Helm chart for CMM in Kubernetes using operators
+        keywords: []
+        maintainers: []
+        icon: https://www.nokia.com/chart-icon.png
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: ""
+        deprecated: false
+        annotations:
+            charts.openshift.io/archs: x86_64
+            charts.openshift.io/name: Nokia CMM
+            charts.openshift.io/provider: Nokia
+            charts.openshift.io/supportURL: https://github.com/nokiacmm/helm-chart
+        kubeversion: '>= 1.20.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : quay.io/nepravee/cmm-operator:CMM25.7.0.0'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+
diff --git a/charts/partners/nonamesec/noname-security-sensor-ubi/3.3.45-rhel/report.yaml b/charts/partners/nonamesec/noname-security-sensor-ubi/3.3.45-rhel/report.yaml
new file mode 100644
index 000000000..57ffa4e23
--- /dev/null
+++ b/charts/partners/nonamesec/noname-security-sensor-ubi/3.3.45-rhel/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:12375938402040610962
+        chart-uri: N/A
+        digests:
+            chart: sha256:e9fffc555ffc2ddbf7be886d08ffff738a29395c335905b89bb730988aa0bf6b
+            package: af8ce4af306b57f009d255e494cc62fa25adadb404ea5e0425c58b836b99c6e2
+        lastCertifiedTimestamp: "2025-08-24T15:49:50.470739+00:00"
+        testedOpenShiftVersion: "4.18"
+        supportedOpenShiftVersions: '>=4.9'
+        webCatalogOnly: true
+    chart:
+        name: noname-security-sensor-ubi
+        home: ""
+        sources: []
+        version: 3.3.45-rhel
+        description: A Helm chart for Kubernetes
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.3.45-rhel
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: noname-security-sensor
+        kubeversion: '>=1.22.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: FAIL
+      reason: Chart does not contain NOTES.txt
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/noname-sensor:3.3.45-rhel'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
diff --git a/charts/partners/nonamesec/noname-security-sensor-ubi/3.3.48-rhel/report.yaml b/charts/partners/nonamesec/noname-security-sensor-ubi/3.3.48-rhel/report.yaml
new file mode 100644
index 000000000..ddf9d3d02
--- /dev/null
+++ b/charts/partners/nonamesec/noname-security-sensor-ubi/3.3.48-rhel/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:6908958828179640874
+        chart-uri: N/A
+        digests:
+            chart: sha256:c57168396fefdc5345694fc04c90679d4b3e7c425c63291d7d03716563b0eb00
+            package: 68737239c39746c8399d58d23d374c27084d8d1a3ea3037033494980623a25dc
+        lastCertifiedTimestamp: "2025-10-28T14:46:56.99126+00:00"
+        testedOpenShiftVersion: "4.18"
+        supportedOpenShiftVersions: '>=4.9'
+        webCatalogOnly: true
+    chart:
+        name: noname-security-sensor-ubi
+        home: ""
+        sources: []
+        version: 3.3.48-rhel
+        description: A Helm chart for Kubernetes
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.3.48-rhel
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: noname-security-sensor
+        kubeversion: '>=1.22.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: FAIL
+      reason: Chart does not contain NOTES.txt
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/noname-sensor:3.3.48-rhel'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.46.16-lts/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.46.16-lts/report.yaml
new file mode 100644
index 000000000..7c8849069
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.46.16-lts/report.yaml
@@ -0,0 +1,168 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:16815478814945506975
+        chart-uri: N/A
+        digests:
+            chart: sha256:927de9ccfe91d02556edec97aa971ed3f9c3d6c8342b332e1733e5c51ecf6588
+            package: 990b359e6681f8fd88b7681b4ee290706f23645022ca3c35e15d2567de0ca072
+        lastCertifiedTimestamp: "2025-08-25T13:02:13.10221+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.46.16-lts
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.46.16-lts
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: rabbitmq
+              version: 15.3.3
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.46.16-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.46.16-lts-ubi
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.46.16/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.46.16/report.yaml
new file mode 100644
index 000000000..638109216
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.46.16/report.yaml
@@ -0,0 +1,168 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:17111216184872945242
+        chart-uri: N/A
+        digests:
+            chart: sha256:0ec07696447fef75fcfe19c4117476da96f281738f01c5898fd90b267f442b7b
+            package: 45ad54c54745be028c40e0ecad855fca9051490a3c555890dd2049afd70806b4
+        lastCertifiedTimestamp: "2025-08-13T17:01:59.642805+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.46.16
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.46.16
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: rabbitmq
+              version: 15.3.3
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.46.16-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.46.18-lts/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.46.18-lts/report.yaml
new file mode 100644
index 000000000..ab2973b89
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.46.18-lts/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:4984181621926751695
+        chart-uri: N/A
+        digests:
+            chart: sha256:4284e9687c1e6770df8cb14407e9997260181b67e4eab76cc349caf43e5d3b52
+            package: eb015e37ae7877920ed161160804637d82f7644ce54006864cb441da178008c1
+        lastCertifiedTimestamp: "2025-09-14T08:50:22.912003+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.46.18-lts
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.46.18-lts
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 15.3.3
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.46.18-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.46.18-lts-ubi
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.46.19-lts/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.46.19-lts/report.yaml
new file mode 100644
index 000000000..e68b1e4a2
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.46.19-lts/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:11753105463361439076
+        chart-uri: N/A
+        digests:
+            chart: sha256:86bc985aabafc0f512403fe6fe1be84628a53067bc58d88b0919a7705cc3a392
+            package: 5cb7838329897f4d4858363601dc9e6a2db65dc73f5537e4a1b9f1c21b6851f1
+        lastCertifiedTimestamp: "2025-09-25T07:22:10.823857+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.46.19-lts
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.46.19-lts
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 15.3.3
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.46.19-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.46.19/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.46.19/report.yaml
new file mode 100644
index 000000000..4e834fb48
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.46.19/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:3904875955284744433
+        chart-uri: N/A
+        digests:
+            chart: sha256:9dba60c438eaddd746742ffd25f3d8afe3208ae05b364295bcb62533fc850a50
+            package: 7ec7ecb131632e8254851e17be9932a3c2e0fe2cae064b345fa3f7b05f975757
+        lastCertifiedTimestamp: "2025-09-24T17:55:25.285829+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.46.19
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.46.19
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 15.3.3
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.46.19-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.46.19-ubi
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.50.10/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.50.10/report.yaml
index f6c15b3d7..0a3fb8736 100644
--- a/charts/partners/nonamesec/nonamesec-ubi/3.50.10/report.yaml
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.50.10/report.yaml
@@ -2,16 +2,16 @@ apiversion: v1
 kind: verify-report
 metadata:
     tool:
-        verifier-version: 1.13.12
+        verifier-version: 1.13.13
         profile:
             VendorType: partner
             version: v1.3
-        reportDigest: uint64:9967585103493683000
+        reportDigest: uint64:11389317863926249193
         chart-uri: N/A
         digests:
             chart: sha256:169d2eeb29e0765e29678b688d66ac1c298e0bf5a1b33bf4960446930224098f
             package: a25cb0a9503afbb8f44e1b675c96a60f6d9d88f26b8e58ba9a8b105cb95b82cc
-        lastCertifiedTimestamp: "2025-07-22T16:52:10.379593+00:00"
+        lastCertifiedTimestamp: "2025-09-04T12:53:28.488786+00:00"
         testedOpenShiftVersion: "4.14"
         supportedOpenShiftVersions: '>=4.1'
         webCatalogOnly: true
@@ -37,73 +37,45 @@ metadata:
               version: 0.1.0
               repository: file://charts/noname
               condition: global.noname.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: engine
               version: 0.1.0
               repository: file://charts/engine
               condition: global.engine.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: active
               version: 0.1.0
               repository: file://charts/active
               condition: global.active.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: platform
               version: 0.1.0
               repository: file://charts/platform
               condition: global.platform.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: router
               version: 0.1.0
               repository: file://charts/router
               condition: global.router.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: noagentapi
               version: 0.1.0
               repository: file://charts/noagentapi
               condition: noagentapi.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: rabbitmq
               version: 15.3.3
               repository: file://charts/rabbitmq
               condition: global.noname.enabled,global.rabbitmq.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
             - name: nns-eso
               version: 0.1.0
               repository: file://charts/nns-eso
               condition: global.nns_eso.enabled
-              tags: []
-              enabled: false
-              importvalues: []
-              alias: ""
         type: ""
     chart-overrides: ""
 results:
-    - check: v1.0/required-annotations-present
+    - check: v1.0/contains-values-schema
       type: Mandatory
       outcome: PASS
-      reason: All required annotations present
+      reason: Values schema file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
     - check: v1.0/helm-lint
       type: Mandatory
       outcome: PASS
@@ -112,56 +84,52 @@ results:
       type: Mandatory
       outcome: PASS
       reason: |-
-        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.50.10-ubi
-        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
         Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.50.10-ubi
-        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
         Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.50.10-ubi
         Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.50.10-ubi
-        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.50.10-ubi
         Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.50.10-ubi
-        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.50.10-ubi
         Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.50.10-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.50.10-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.50.10-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.50.10-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
     - check: v1.0/signature-is-valid
       type: Mandatory
       outcome: SKIPPED
       reason: 'Chart is not signed : Signature verification not required'
-    - check: v1.0/has-notes
-      type: Optional
-      outcome: PASS
-      reason: Chart does contain NOTES.txt
-    - check: v1.1/has-kubeversion
+    - check: v1.0/chart-testing
       type: Mandatory
       outcome: PASS
-      reason: Kubernetes version specified
+      reason: Chart tests have passed
     - check: v1.0/contains-test
       type: Mandatory
       outcome: PASS
       reason: Chart test files exist
-    - check: v1.0/contains-values-schema
-      type: Mandatory
-      outcome: PASS
-      reason: Values schema file exist
-    - check: v1.0/not-contain-csi-objects
+    - check: v1.0/contains-values
       type: Mandatory
       outcome: PASS
-      reason: CSI objects do not exist
-    - check: v1.0/chart-testing
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
       type: Mandatory
       outcome: PASS
-      reason: Chart tests have passed
+      reason: Kubernetes version specified
     - check: v1.0/is-helm-v3
       type: Mandatory
       outcome: PASS
       reason: API version is V2, used in Helm 3
-    - check: v1.0/not-contains-crds
-      type: Mandatory
-      outcome: PASS
-      reason: Chart does not contain CRDs
-    - check: v1.0/contains-values
-      type: Mandatory
-      outcome: PASS
-      reason: Values file exist
     - check: v1.0/has-readme
       type: Mandatory
       outcome: PASS
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.51.12/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.51.12/report.yaml
new file mode 100644
index 000000000..d8a96d471
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.51.12/report.yaml
@@ -0,0 +1,168 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:13404734493473314097
+        chart-uri: N/A
+        digests:
+            chart: sha256:faa9623c1ef24ff57c04cb3c57da2a3be29ee495eea116368434222cedbe8cb9
+            package: 692b7079f666bab62910148cb8cceb3fe07fe27af53477d6e39c0aa6b4a0c95a
+        lastCertifiedTimestamp: "2025-08-18T08:16:30.580055+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.51.12
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.51.12
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: rabbitmq
+              version: 15.3.3
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.51.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.51.12-ubi
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.52.12-lts/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.52.12-lts/report.yaml
new file mode 100644
index 000000000..fe24b0788
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.52.12-lts/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:11300579006577191045
+        chart-uri: N/A
+        digests:
+            chart: sha256:2caa8022576f526de8739631e09c45238280122ab37de241597bf0dffd0e0068
+            package: 6f81f93fc4007b42b2be4d0f7d2abab15bda0485ff387bf16913a9d6517f2661
+        lastCertifiedTimestamp: "2025-10-13T09:23:18.314605+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.52.12-lts
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.52.12-lts
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.52.12-lts-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.52.12-lts-ubi
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.52.12/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.52.12/report.yaml
new file mode 100644
index 000000000..2e12f663f
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.52.12/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:15653145310527682182
+        chart-uri: N/A
+        digests:
+            chart: sha256:bd22dc3deb1a436610a23b31f17a06adbf3c8ff34bfd35ec21bf54ef81bf89e2
+            package: 917a02c2a7ca20554e4ae74849ac2854d4b9025d91c98b5f7e97bc7e82e47fcc
+        lastCertifiedTimestamp: "2025-10-12T19:46:49.813461+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.52.12
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.52.12
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.52.12-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.52.12-ubi
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.52.2/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.52.2/report.yaml
new file mode 100644
index 000000000..7b6cc21b2
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.52.2/report.yaml
@@ -0,0 +1,168 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:9949354059739948514
+        chart-uri: N/A
+        digests:
+            chart: sha256:3584f73e12774a9bc407a9684a130dec66dbab4c91fe4a52f482aab419ffdf6b
+            package: c9676ffe0e99e94666abcd23dafaf27408e6a16ad17e4428be7860a6d2bc0a09
+        lastCertifiedTimestamp: "2025-08-13T18:51:55.358152+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.52.2
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.52.2
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.52.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.52.3/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.52.3/report.yaml
new file mode 100644
index 000000000..8193ec267
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.52.3/report.yaml
@@ -0,0 +1,168 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:5644328632330665108
+        chart-uri: N/A
+        digests:
+            chart: sha256:ae342df8b2ed45ed2111cc65238308042e1f2667e8594d89c23c72ca332609fb
+            package: 62127983c1e5675089cc1a2dd173ac3d86476963eb4c7c402fd2f4a5c56bb59f
+        lastCertifiedTimestamp: "2025-08-15T11:44:35.629844+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.52.3
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.52.3
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.52.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.52.5/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.52.5/report.yaml
new file mode 100644
index 000000000..52874d80c
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.52.5/report.yaml
@@ -0,0 +1,168 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:16950188967590126126
+        chart-uri: N/A
+        digests:
+            chart: sha256:92d908c14d2b1f2b7d3b197a4753d3b0dff09d692e5f253523756f61059b3790
+            package: 32bd77f837d92be8b7e8d0a157a8fab8def1b418d647dbd318c6c84c89cf30b2
+        lastCertifiedTimestamp: "2025-08-26T10:29:52.520157+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.52.5
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.52.5
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+              tags: []
+              enabled: false
+              importvalues: []
+              alias: ""
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.52.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.52.6/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.52.6/report.yaml
new file mode 100644
index 000000000..98212adec
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.52.6/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:10574780437485782849
+        chart-uri: N/A
+        digests:
+            chart: sha256:eea3df9066cd35a8bafcf7a201ee1a229f13c003a9889b8eda997ca1247cb0a2
+            package: 0c83e36105a229a5df36155182ebc5d4b1d2471afad7947779b8db85578dd845
+        lastCertifiedTimestamp: "2025-08-27T19:12:13.22645+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.52.6
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.52.6
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.10.24-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.52.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.52.6-ubi
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.0/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.0/report.yaml
new file mode 100644
index 000000000..aafc776f3
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.0/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:9171125778743196088
+        chart-uri: N/A
+        digests:
+            chart: sha256:c2b3fe60dce3afbdcc36383623e5a39196ad710d7f1cd548591d3485312bb089
+            package: 9031e9726c8ab7cc3029708c4e4a50e3f51874e27e7f80489e4d36cc0b23570c
+        lastCertifiedTimestamp: "2025-09-22T12:32:23.96417+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.0
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.1/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.1/report.yaml
new file mode 100644
index 000000000..1531fba5a
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.1/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:13152654588417889492
+        chart-uri: N/A
+        digests:
+            chart: sha256:b51d087925fa35b8f35cd60a7f04fb837b3deb4cdd7b3d119ba3c3031af9a48b
+            package: 4b0ceb4a8394b9ab9185414e54bd07bcdbb368bc1a5be948665b3ea9425bac8e
+        lastCertifiedTimestamp: "2025-09-25T22:46:17.751738+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.1
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.1
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.2/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.2/report.yaml
new file mode 100644
index 000000000..ba7e97005
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.2/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:13266130153820403037
+        chart-uri: N/A
+        digests:
+            chart: sha256:ca5b13048d5388b6b47037b764566c68e47699874156298b27e5ff290f3c1c62
+            package: dff7906f5e134ab39588b30133da32e5bef1e16fa5a830d1bb76fc39804603c8
+        lastCertifiedTimestamp: "2025-09-28T13:21:51.598303+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.2
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.2
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.2-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.2-ubi
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.3/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.3/report.yaml
new file mode 100644
index 000000000..eac03e7f6
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.3/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:14094296532967150236
+        chart-uri: N/A
+        digests:
+            chart: sha256:03a874525f44ab9e8f1f3467755b002cfe24d4c9e85efba7bd387e8ecfedb4d4
+            package: 1e36b08c70057049a57bd8451c6ddd37f06a76a9f257c24719fa9288d2a4a45f
+        lastCertifiedTimestamp: "2025-09-29T23:24:12.205149+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.3
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.3
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.3-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.3-ubi
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.4/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.4/report.yaml
new file mode 100644
index 000000000..0b0aab167
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.4/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:5318266408470884639
+        chart-uri: N/A
+        digests:
+            chart: sha256:7ae673278dfd8ce08ace7b73a59ea242cbe397b72dbb1a453509b713aa65d609
+            package: fbb2acecfb7db8b410c958bd0c7486f86bbc3775fdd3dee9c10a09243f1fda0a
+        lastCertifiedTimestamp: "2025-10-05T12:08:10.06071+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.4
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.4
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.4-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.4-ubi
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.5/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.5/report.yaml
new file mode 100644
index 000000000..59b81c870
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.5/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:16709599906067808309
+        chart-uri: N/A
+        digests:
+            chart: sha256:aceac87fc2d77f5c59eb5d3496e35dcdf3cd56362712cd072d01057e4e0b1df8
+            package: e420dac0a1255324381ce8b18e32fca3a06f7c3ebc8204e9ef2c8f20dd795d75
+        lastCertifiedTimestamp: "2025-10-05T16:37:44.691029+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.5
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.5
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.5-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.5-ubi
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.54.6/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.54.6/report.yaml
new file mode 100644
index 000000000..be9e3ce18
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.54.6/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:8143103118169684658
+        chart-uri: N/A
+        digests:
+            chart: sha256:66525e71aeaf2ff133fd4147a4963dfb2e6fd1126a33c5377daa2a64fb09ac71
+            package: f7fe9a6f114b773fb341b94da5df687ef07ad2d508a71c8fbedfc1008244cfc3
+        lastCertifiedTimestamp: "2025-10-12T19:38:16.353512+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.54.6
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.54.6
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.54.6-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.55.0/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.55.0/report.yaml
new file mode 100644
index 000000000..7b2e73bd8
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.55.0/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:679745173603969496
+        chart-uri: N/A
+        digests:
+            chart: sha256:d13185dbb8741299843bc20fce2c8169998cfc50e5b0a8b9c16b4a81365b7dee
+            package: b1417e0bf01e122551d6f9097b5e7011767de0faded4805ccaa046f46654b0cc
+        lastCertifiedTimestamp: "2025-10-12T17:32:22.223271+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.55.0
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.55.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.55.0-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.55.0-ubi
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
diff --git a/charts/partners/nonamesec/nonamesec-ubi/3.55.1/report.yaml b/charts/partners/nonamesec/nonamesec-ubi/3.55.1/report.yaml
new file mode 100644
index 000000000..79ef90f2f
--- /dev/null
+++ b/charts/partners/nonamesec/nonamesec-ubi/3.55.1/report.yaml
@@ -0,0 +1,136 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:2449870859770745764
+        chart-uri: N/A
+        digests:
+            chart: sha256:e2d0e6c501afdadd24da0b8b218fbbbb066e2c2c7ba726418e13169e7ce2120a
+            package: 6bd54a09cdb4481771fd6c158d73f4ea1ddc91951177a4a6f2cd75657b14490d
+        lastCertifiedTimestamp: "2025-10-12T19:40:45.848763+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: nonamesec-ubi
+        home: ""
+        sources: []
+        version: 3.55.1
+        description: Noname Helm on k8s
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 3.55.1
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Engine
+        kubeversion: '>=1.0.0-0'
+        dependencies:
+            - name: noname
+              version: 0.1.0
+              repository: file://charts/noname
+              condition: global.noname.enabled
+            - name: engine
+              version: 0.1.0
+              repository: file://charts/engine
+              condition: global.engine.enabled
+            - name: active
+              version: 0.1.0
+              repository: file://charts/active
+              condition: global.active.enabled
+            - name: platform
+              version: 0.1.0
+              repository: file://charts/platform
+              condition: global.platform.enabled
+            - name: router
+              version: 0.1.0
+              repository: file://charts/router
+              condition: global.router.enabled
+            - name: noagentapi
+              version: 0.1.0
+              repository: file://charts/noagentapi
+              condition: noagentapi.enabled
+            - name: rabbitmq
+              version: 16.0.11
+              repository: file://charts/rabbitmq
+              condition: global.noname.enabled,global.rabbitmq.enabled
+            - name: nns-eso
+              version: 0.1.0
+              repository: file://charts/nns-eso
+              condition: global.nns_eso.enabled
+        type: ""
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nats-jetstream:2.11.9-custom-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/light-engine:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/cloud-metadata:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/heavy-engine:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/integrations-adapter:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nogate:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/platform-integrations:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/rhel8/postgresql-15:1-66.1716485364
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/router:v3.55.1-ubi
+        Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/nginx:v3.55.1-ubi
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.51.12/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.51.12/report.yaml
new file mode 100644
index 000000000..bec0d965d
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.51.12/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:6409409880195626668
+        chart-uri: N/A
+        digests:
+            chart: sha256:ec2c6bb8a7d42b478b2194169f26033f7130d62f8d48c2afc27911a5f60c7265
+            package: 31710a32e340a801297ed43c9532a5a130441217677d8215959b8fca1b545e76
+        lastCertifiedTimestamp: "2025-08-18T08:17:22.349906+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.51.12
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.39.1-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.39.1-ubi'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.52.10/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.10/report.yaml
new file mode 100644
index 000000000..59830f52a
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.10/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:18444639939885685627
+        chart-uri: N/A
+        digests:
+            chart: sha256:6ee6332acd58a7191fc69c89c3a661615e809c112566749d5cc2fcf326bb87cc
+            package: 0db80361fc4d9961683b51ddac2f24517b791055fc0254b6710a5728bfaf121d
+        lastCertifiedTimestamp: "2025-09-14T09:01:20.142897+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.52.10
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.40.1-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.40.1-ubi'
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.52.12/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.12/report.yaml
new file mode 100644
index 000000000..e9efb1f4a
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.12/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:17725084888578138008
+        chart-uri: N/A
+        digests:
+            chart: sha256:6e90bd5d3577241c2e8e4d9570c18d792bfeb07a9d5b5953618aadf318caeb6d
+            package: 8a037f77f37512c81e969902fe73d044050157677690a0e19f26fcf535cc95d6
+        lastCertifiedTimestamp: "2025-10-12T19:47:28.487893+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.52.12
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.40.2-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.40.2-ubi'
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.52.3/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.3/report.yaml
new file mode 100644
index 000000000..fa963da25
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.3/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:6117234136746615951
+        chart-uri: N/A
+        digests:
+            chart: sha256:d15bf8a75bf34170558497140a222480ee05ee0f352df9d7947779a5cf25ec6e
+            package: 49f8900d9a5c3eea4aea1b5816b11a44b746450b0eba1b4dde233589dc852dd1
+        lastCertifiedTimestamp: "2025-08-15T11:47:27.782184+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.52.3
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.40.1-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.40.1-ubi'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.52.4/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.4/report.yaml
new file mode 100644
index 000000000..eb566cadf
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.4/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:10227172559661340712
+        chart-uri: N/A
+        digests:
+            chart: sha256:3a56e2509759a548fe72f9767b85d9f9ded3b275fac342e9226d7de2ed8f0970
+            package: 543982e25ba0f451ec860af903cecac240d9c75b6e7d34956d687855918b4dfa
+        lastCertifiedTimestamp: "2025-08-18T19:38:50.287444+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.52.4
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.40.1-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.40.1-ubi'
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.52.5/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.5/report.yaml
new file mode 100644
index 000000000..da7d7f36b
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.5/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:1690450249209918892
+        chart-uri: N/A
+        digests:
+            chart: sha256:f6b92c15c4e8c155daea6135cd73df2e7119dbb7994526b083cc536a9624a577
+            package: 793881e37b8c23f5ec1777b9f4119ff980e7f5379d39b777b32a41d6af29a3fd
+        lastCertifiedTimestamp: "2025-08-26T10:30:30.74251+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.52.5
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.40.1-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.40.1-ubi'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.52.6/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.6/report.yaml
new file mode 100644
index 000000000..9991dcac2
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.52.6/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:4563630743727597206
+        chart-uri: N/A
+        digests:
+            chart: sha256:7c7d697549f7eef8ffe02922cd1010652da58359b206a24dfcf844a9857cbe4d
+            package: a11d1e3765d309d1476169643c7bd4300df3f42a8999a93a18dc2fb4a9f7ed1e
+        lastCertifiedTimestamp: "2025-08-27T19:12:59.075834+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.52.6
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.40.1-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.40.1-ubi'
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.53.5/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.53.5/report.yaml
new file mode 100644
index 000000000..10590de91
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.53.5/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:793797568995286217
+        chart-uri: N/A
+        digests:
+            chart: sha256:7a7406a2bde8c8d2a8c3607becb98a70304df6147757553aee7eb21520d8745a
+            package: ff8ff0f614024d65b66714adba74ab3f7199d209e39d33341aaaf9a3536f73d7
+        lastCertifiedTimestamp: "2025-10-12T19:33:57.503413+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.53.5
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.41.2-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.41.2-ubi'
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.0/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.0/report.yaml
new file mode 100644
index 000000000..ddb9262bd
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.0/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:17181941315337769310
+        chart-uri: N/A
+        digests:
+            chart: sha256:f0c0f91d67b1fefda8465d60e8ad201604966041695175e847a264223c3cd42f
+            package: 8c1dea397155617ccbf610659fa397cfc70dd6f069ceb1733e992856c35cfaa0
+        lastCertifiedTimestamp: "2025-09-22T12:31:39.97555+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.0
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.0-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.0-ubi'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.1/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.1/report.yaml
new file mode 100644
index 000000000..dbaec725c
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.1/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:4440219209400846058
+        chart-uri: N/A
+        digests:
+            chart: sha256:d3f696a98d651ad3304cb2408386948ce43a86c4f01eaf33a1d66dc16273e3c8
+            package: d72e6a25c43154de2fae2ba57d9212b19983c0a2cac88f499369699bddbfdfd6
+        lastCertifiedTimestamp: "2025-09-25T22:46:24.070282+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.1
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.0-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.0-ubi'
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.2/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.2/report.yaml
new file mode 100644
index 000000000..6662d1095
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.2/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:3614955393371131360
+        chart-uri: N/A
+        digests:
+            chart: sha256:e4db0cae3d3b4be9fcfc9e572571777c33c892fa7b60d881f7fbc33a3f0615b6
+            package: 96cba02073caaf5f8789040c11aad50d5ddc135b13e9ba3620dd5f91f360bfb0
+        lastCertifiedTimestamp: "2025-09-28T13:25:43.360735+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.2
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.2-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.2-ubi'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.3/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.3/report.yaml
new file mode 100644
index 000000000..4a9ac3312
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.3/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:13845704216768748260
+        chart-uri: N/A
+        digests:
+            chart: sha256:e588eda80072e1a8688aeaccb3a2b3b3c849e04e4d34301d5f6e769446dda31f
+            package: 371577d2658f9089600a586d8bfaf60fbdc59c0a406d03cc3a5fbab07c29cac9
+        lastCertifiedTimestamp: "2025-09-29T23:26:17.252117+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.3
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.2-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.2-ubi'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.4/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.4/report.yaml
new file mode 100644
index 000000000..d7d4a917a
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.4/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:14828578039720484990
+        chart-uri: N/A
+        digests:
+            chart: sha256:6b795f67596c2f14f51e37f73ef236cddc44c48d9c25890638caea84adac75e4
+            package: 5a715e391b512510f18bdb2c0b66eed0ccdbad4134f1a093fbc9a5e6a5278f4e
+        lastCertifiedTimestamp: "2025-10-05T12:08:11.656985+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.4
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.2-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.2-ubi'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.5/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.5/report.yaml
new file mode 100644
index 000000000..16c424f35
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.5/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:10000533202949046410
+        chart-uri: N/A
+        digests:
+            chart: sha256:d29f858a39f5f6b4fb626dceb3dac3cd0407be6962b5d793cb5c70463f65a701
+            package: 9b85b34a830af2e0f70987c5f9e6f10a66329ee80ddaee7aa3b72b82d7a49b8e
+        lastCertifiedTimestamp: "2025-10-05T16:38:17.466184+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.5
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.3-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.3-ubi'
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.54.6/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.6/report.yaml
new file mode 100644
index 000000000..6b5cd9544
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.54.6/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:4297311478233356567
+        chart-uri: N/A
+        digests:
+            chart: sha256:498f2b4b318bf4f02aae50e5a494fb50ba0bdbf9ff5662c7b8018929be97c484
+            package: 88ad70f508c02f493d98b1f5582db7aff32b62a655f1f5e8fe028986f805f10a
+        lastCertifiedTimestamp: "2025-10-12T19:38:20.154764+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.54.6
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.42.3-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.42.3-ubi'
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.55.0/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.55.0/report.yaml
new file mode 100644
index 000000000..e9641910a
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.55.0/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:4226577687506554692
+        chart-uri: N/A
+        digests:
+            chart: sha256:a2f5b2bdf02dfc76da8b620e47bfbc7eb15b81877abc565953504f70e0b6b073
+            package: f92a79f5f74c1e07cafc2471241a4ebcb23809e83311a5021e58708ae706ca70
+        lastCertifiedTimestamp: "2025-10-12T17:30:07.757024+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.55.0
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.43.0-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.43.0-ubi'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
diff --git a/charts/partners/nonamesec/remote-active-worker-ubi/3.55.1/report.yaml b/charts/partners/nonamesec/remote-active-worker-ubi/3.55.1/report.yaml
new file mode 100644
index 000000000..535a793e0
--- /dev/null
+++ b/charts/partners/nonamesec/remote-active-worker-ubi/3.55.1/report.yaml
@@ -0,0 +1,94 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:15640518024272999754
+        chart-uri: N/A
+        digests:
+            chart: sha256:e9cbb12531b43ded9f2d601998f8ba1263e40c1216028e8a5235726ee29f22b7
+            package: 9d2c9df00dc1f3a9419bfe04ee6dd0d7adf477252c78bd913e3332035ff26c08
+        lastCertifiedTimestamp: "2025-10-12T19:39:03.958775+00:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.1'
+        webCatalogOnly: true
+    chart:
+        name: remote-active-worker-ubi
+        home: ""
+        sources: []
+        version: 3.55.1
+        description: Active Worker Helm Chart for remote active worker deployments
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.43.0-ubi
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: Remote Active Testing Worker
+        kubeversion: '>=1.0.0-0'
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: 'Image is Red Hat certified : us-central1-docker.pkg.dev/noname-artifacts/nns-docker/active-worker:2.43.0-ubi'
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
diff --git a/charts/partners/not-a-real-company/helm-testing/OWNERS b/charts/partners/not-a-real-company/helm-testing/OWNERS
index dcdbb837f..9d2467c58 100644
--- a/charts/partners/not-a-real-company/helm-testing/OWNERS
+++ b/charts/partners/not-a-real-company/helm-testing/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: helm-testing
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/ntest/certpm-test-chart/OWNERS b/charts/partners/ntest/certpm-test-chart/OWNERS
index d192cb95c..ac2aa7ba5 100644
--- a/charts/partners/ntest/certpm-test-chart/OWNERS
+++ b/charts/partners/ntest/certpm-test-chart/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: certpm-test-chart
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/nti-containers/sepp/OWNERS b/charts/partners/nti-containers/sepp/OWNERS
index d85af5372..8207e38d7 100644
--- a/charts/partners/nti-containers/sepp/OWNERS
+++ b/charts/partners/nti-containers/sepp/OWNERS
@@ -7,4 +7,4 @@ users:
 - githubUsername: NA
 vendor:
   label: nti-containers
-  name: Titan.ium Platform LLC
+  name: Titan.ium Platform, LLC
diff --git a/charts/partners/openziti/ziti-host/OWNERS b/charts/partners/openziti/ziti-host/OWNERS
index 86b9b3a8f..981684d99 100644
--- a/charts/partners/openziti/ziti-host/OWNERS
+++ b/charts/partners/openziti/ziti-host/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: ziti-host
   shortDescription: Expose cluster services with Ziti
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: qrkourier
 - githubUsername: dovholuknf
diff --git a/charts/partners/opscruise/opscruise/OWNERS b/charts/partners/opscruise/opscruise/OWNERS
index 396de287a..dd47d39eb 100644
--- a/charts/partners/opscruise/opscruise/OWNERS
+++ b/charts/partners/opscruise/opscruise/OWNERS
@@ -2,7 +2,7 @@ chart:
   name: opscruise
   shortDescription: Helm chart for deploying OpsCruise
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: sudheeshopscruise
 - githubUsername: cesar-quintana-opscruise
diff --git a/charts/partners/oracle/weblogic-kubernetes-operator/OWNERS b/charts/partners/oracle/weblogic-kubernetes-operator/OWNERS
new file mode 100644
index 000000000..81894e600
--- /dev/null
+++ b/charts/partners/oracle/weblogic-kubernetes-operator/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: weblogic-kubernetes-operator
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: oracle
+  name: Oracle Corporation
diff --git a/charts/partners/progressoft/corpay-progressoft/OWNERS b/charts/partners/progressoft/corpay-progressoft/OWNERS
index 0ea516f69..a0cf53f9c 100644
--- a/charts/partners/progressoft/corpay-progressoft/OWNERS
+++ b/charts/partners/progressoft/corpay-progressoft/OWNERS
@@ -3,7 +3,7 @@ chart:
   shortDescription: "ProgressSoft\u2019s Corporate Banking (PS-CORPay) Suite introduces\
     \ a solution that enables corporates to manage front-office banking services."
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: nour-alsatari
 - githubUsername: naelalbashir
diff --git a/charts/partners/redhat-arkady-test/demochart7/OWNERS b/charts/partners/redhat-arkady-test/demochart7/OWNERS
index b6aceafb2..578046c86 100644
--- a/charts/partners/redhat-arkady-test/demochart7/OWNERS
+++ b/charts/partners/redhat-arkady-test/demochart7/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: demochart7
-  shortDescription: unknown
+  shortDescription: This is a short description demochart7!
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/mychart/OWNERS b/charts/partners/redhat-arkady-test/mychart/OWNERS
index 3c06354c4..4e49be43f 100644
--- a/charts/partners/redhat-arkady-test/mychart/OWNERS
+++ b/charts/partners/redhat-arkady-test/mychart/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: mychart
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/redhat-arkady-test/newtestchart2/OWNERS b/charts/partners/redhat-arkady-test/newtestchart2/OWNERS
index c166c5c56..d5e5fcea5 100644
--- a/charts/partners/redhat-arkady-test/newtestchart2/OWNERS
+++ b/charts/partners/redhat-arkady-test/newtestchart2/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: newtestchart2
-  shortDescription: unknown
+  shortDescription: This is a short description newtestchart2!
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/newtestchart5/OWNERS b/charts/partners/redhat-arkady-test/newtestchart5/OWNERS
index 80830b417..97a2c2b78 100644
--- a/charts/partners/redhat-arkady-test/newtestchart5/OWNERS
+++ b/charts/partners/redhat-arkady-test/newtestchart5/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: newtestchart5
-  shortDescription: unknown
+  shortDescription: This is a short description newtestchart5!
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/newtestchart6/OWNERS b/charts/partners/redhat-arkady-test/newtestchart6/OWNERS
index 453197236..78a3d7372 100644
--- a/charts/partners/redhat-arkady-test/newtestchart6/OWNERS
+++ b/charts/partners/redhat-arkady-test/newtestchart6/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: newtestchart6
-  shortDescription: unknown
+  shortDescription: This is a short description newtestchart6!
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/newtestchart7/OWNERS b/charts/partners/redhat-arkady-test/newtestchart7/OWNERS
index 93f7d7613..193237860 100644
--- a/charts/partners/redhat-arkady-test/newtestchart7/OWNERS
+++ b/charts/partners/redhat-arkady-test/newtestchart7/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: newtestchart7
-  shortDescription: unknown
+  shortDescription: This is a short description newtestchart7!
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/test1/OWNERS b/charts/partners/redhat-arkady-test/test1/OWNERS
index 114573507..76368580d 100644
--- a/charts/partners/redhat-arkady-test/test1/OWNERS
+++ b/charts/partners/redhat-arkady-test/test1/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: test1
   shortDescription: Short description of a Helm chart project.
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: wying3
 - githubUsername: sebrandon1
diff --git a/charts/partners/redhat-arkady-test/testchart1/OWNERS b/charts/partners/redhat-arkady-test/testchart1/OWNERS
index 287a57c22..f659bcb73 100644
--- a/charts/partners/redhat-arkady-test/testchart1/OWNERS
+++ b/charts/partners/redhat-arkady-test/testchart1/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: testchart1
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: yinwang@redhat.com
 vendor:
diff --git a/charts/partners/redhat-arkady-test/testchart11/OWNERS b/charts/partners/redhat-arkady-test/testchart11/OWNERS
index a5fc05f45..546671f7e 100644
--- a/charts/partners/redhat-arkady-test/testchart11/OWNERS
+++ b/charts/partners/redhat-arkady-test/testchart11/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: testchart11
-  shortDescription: unknown
+  shortDescription: This is a short description testchart11
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/testchart12/OWNERS b/charts/partners/redhat-arkady-test/testchart12/OWNERS
index e5a69d622..1d6d60fb2 100644
--- a/charts/partners/redhat-arkady-test/testchart12/OWNERS
+++ b/charts/partners/redhat-arkady-test/testchart12/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: testchart12
-  shortDescription: unknown
+  shortDescription: This is a short description testchart12
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-arkady-test/testchartpr1/OWNERS b/charts/partners/redhat-arkady-test/testchartpr1/OWNERS
index fb1f0c796..1a6dc9eb9 100644
--- a/charts/partners/redhat-arkady-test/testchartpr1/OWNERS
+++ b/charts/partners/redhat-arkady-test/testchartpr1/OWNERS
@@ -1,6 +1,6 @@
 chart:
   name: testchartpr1
-  shortDescription: unknown
+  shortDescription: This is a short description testchartprrrrrrrrrrrrrrrr
 providerDelivery: true
 publicPgpKey: unknown
 users:
diff --git a/charts/partners/redhat-test/chart-helm-two-nine/OWNERS b/charts/partners/redhat-test/chart-helm-two-nine/OWNERS
new file mode 100644
index 000000000..1ea075b41
--- /dev/null
+++ b/charts/partners/redhat-test/chart-helm-two-nine/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: chart-helm-two-nine
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: redhat-test
+  name: Red Hat, Inc.
diff --git a/charts/partners/redhat-test/chartprodhelm/OWNERS b/charts/partners/redhat-test/chartprodhelm/OWNERS
index 176e6d507..229d8af6e 100644
--- a/charts/partners/redhat-test/chartprodhelm/OWNERS
+++ b/charts/partners/redhat-test/chartprodhelm/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: chartprodhelm
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: Aishwarya-Urne
 vendor:
diff --git a/charts/partners/redhat-test/helm-12/OWNERS b/charts/partners/redhat-test/helm-12/OWNERS
new file mode 100644
index 000000000..6aa3f914b
--- /dev/null
+++ b/charts/partners/redhat-test/helm-12/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: helm-12
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: redhat-test
+  name: Red Hat, Inc.
diff --git a/charts/partners/redhat-test/testtstst/OWNERS b/charts/partners/redhat-test/testtstst/OWNERS
new file mode 100644
index 000000000..224914848
--- /dev/null
+++ b/charts/partners/redhat-test/testtstst/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: testtstst
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: redhat-test
+  name: Red Hat, Inc.
diff --git a/charts/partners/reform/reform-deploy/0.9.1/report.yaml b/charts/partners/reform/reform-deploy/0.9.1/report.yaml
new file mode 100644
index 000000000..81b1ba137
--- /dev/null
+++ b/charts/partners/reform/reform-deploy/0.9.1/report.yaml
@@ -0,0 +1,103 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.12
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:5843596263160510430
+        chart-uri: N/A
+        digests:
+            chart: sha256:b1e4918890315c377a007fb9dab9ab08c6aa9ee1e853cc56096f959a23000932
+            package: cc10f10d76720542ab6f563f7dad105ace4b10a47fad5e5e37fa74145010b4df
+        lastCertifiedTimestamp: "2025-09-03T15:32:38.981411+08:00"
+        testedOpenShiftVersion: "4.14"
+        supportedOpenShiftVersions: '>=4.6'
+        webCatalogOnly: true
+    chart:
+        name: reform-deploy
+        home: ""
+        sources: []
+        version: 0.9.1
+        description: A Helm chart for Kubernetes
+        keywords: []
+        maintainers: []
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 0.7.0
+        deprecated: false
+        annotations:
+            charts.openshift.io/name: reformdeploy
+        kubeversion: '>=1.19.0-0'
+        dependencies:
+            - name: hermitcrab
+              version: 0.1.4
+              repository: file://../hermitcrab
+              condition: hermitcrab.enabled
+              tags:
+                - hermitcrab
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : registry.access.redhat.com/ubi9/toolbox
+        Image is Red Hat certified : 602760177850.dkr.ecr.ap-southeast-1.amazonaws.com/reform/infra/server:v0.7.0-b11-ubi
+        Image is Red Hat certified : 602760177850.dkr.ecr.ap-southeast-1.amazonaws.com/reform/infra/hermitcrab:v1.0.2-ubi
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
diff --git a/charts/partners/reform/reform-deploy/OWNERS b/charts/partners/reform/reform-deploy/OWNERS
new file mode 100644
index 000000000..b4a8f1a83
--- /dev/null
+++ b/charts/partners/reform/reform-deploy/OWNERS
@@ -0,0 +1,12 @@
+chart:
+  name: reform-deploy
+  shortDescription: Provides a faster and smarter way to simplify application delivery
+    and infrastructure provisioning.
+providerDelivery: true
+publicPgpKey: unknown
+users:
+- githubUsername: leoatreslv
+- githubUsername: kreslv
+vendor:
+  label: reform
+  name: Resolve Technology Limited
diff --git a/charts/partners/sjpark00/hello-python-operator/OWNERS b/charts/partners/sjpark00/hello-python-operator/OWNERS
new file mode 100644
index 000000000..9be411f3e
--- /dev/null
+++ b/charts/partners/sjpark00/hello-python-operator/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: hello-python-operator
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: sjpark00
+  name: DreamSecurity Co., Ltd.
diff --git a/charts/partners/sjpark00/hello-python/OWNERS b/charts/partners/sjpark00/hello-python/OWNERS
new file mode 100644
index 000000000..fedc5f8ff
--- /dev/null
+++ b/charts/partners/sjpark00/hello-python/OWNERS
@@ -0,0 +1,9 @@
+chart:
+  name: hello-python
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
+users: []
+vendor:
+  label: sjpark00
+  name: DreamSecurity Co., Ltd.
diff --git a/charts/partners/solace/pubsubplus-openshift-dev/OWNERS b/charts/partners/solace/pubsubplus-openshift-dev/OWNERS
index 80ddc7034..3b608ee25 100644
--- a/charts/partners/solace/pubsubplus-openshift-dev/OWNERS
+++ b/charts/partners/solace/pubsubplus-openshift-dev/OWNERS
@@ -2,7 +2,8 @@ chart:
   name: pubsubplus-openshift-dev
   shortDescription: Deploy a single-node non-HA Solace PubSub+ Event Broker Software
     on OpenShift for development purposes
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: bczoma
 - githubUsername: juddrobertson
diff --git a/charts/partners/solace/pubsubplus-openshift-ha/OWNERS b/charts/partners/solace/pubsubplus-openshift-ha/OWNERS
index 448e543dc..b2d198b83 100644
--- a/charts/partners/solace/pubsubplus-openshift-ha/OWNERS
+++ b/charts/partners/solace/pubsubplus-openshift-ha/OWNERS
@@ -2,7 +2,8 @@ chart:
   name: pubsubplus-openshift-ha
   shortDescription: Deploy an HA redundancy group of Solace PubSub+ Event Broker Software
     on OpenShift
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: bczoma
 - githubUsername: juddrobertson
diff --git a/charts/partners/solace/pubsubplus-openshift/OWNERS b/charts/partners/solace/pubsubplus-openshift/OWNERS
index 5773667de..ca68c2bf2 100644
--- a/charts/partners/solace/pubsubplus-openshift/OWNERS
+++ b/charts/partners/solace/pubsubplus-openshift/OWNERS
@@ -2,7 +2,8 @@ chart:
   name: pubsubplus-openshift
   shortDescription: Deploy a single-node non-HA Solace PubSub+ Event Broker Software
     on OpenShift
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: bczoma
 - githubUsername: juddrobertson
diff --git a/charts/partners/solo-io/gloo-ee-helm/OWNERS b/charts/partners/solo-io/gloo-ee-helm/OWNERS
index f54ed263d..7e91ad3ed 100644
--- a/charts/partners/solo-io/gloo-ee-helm/OWNERS
+++ b/charts/partners/solo-io/gloo-ee-helm/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: gloo-ee-helm
   shortDescription: Gloo Edge Enterprise Helm Chart
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: djannot
 vendor:
diff --git a/charts/partners/solo-io/gloo-mesh-enterprise/OWNERS b/charts/partners/solo-io/gloo-mesh-enterprise/OWNERS
index e75b07dfb..ca517605d 100644
--- a/charts/partners/solo-io/gloo-mesh-enterprise/OWNERS
+++ b/charts/partners/solo-io/gloo-mesh-enterprise/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: gloo-mesh-enterprise
   shortDescription: Gloo Mesh Enterprise Helm Chart
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: djannot
 vendor:
diff --git a/charts/partners/streebo/streebo-chatbot/OWNERS b/charts/partners/streebo/streebo-chatbot/OWNERS
index 9f428459d..75b7973b8 100644
--- a/charts/partners/streebo/streebo-chatbot/OWNERS
+++ b/charts/partners/streebo/streebo-chatbot/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: streebo-chatbot
   shortDescription: Helm chart for Streebo Chatbot Builder.
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: abrarstreebo
 vendor:
diff --git a/charts/partners/taylor-test-company/chart-test/OWNERS b/charts/partners/taylor-test-company/chart-test/OWNERS
index fdc7a8c29..2f1e0bbef 100644
--- a/charts/partners/taylor-test-company/chart-test/OWNERS
+++ b/charts/partners/taylor-test-company/chart-test/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: chart-test
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/test/chartname-cnf/OWNERS b/charts/partners/test/chartname-cnf/OWNERS
index 04915f00c..d1a3a7d2f 100644
--- a/charts/partners/test/chartname-cnf/OWNERS
+++ b/charts/partners/test/chartname-cnf/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: chartname-cnf
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/partners/test467/dvdv/OWNERS b/charts/partners/test467/dvdv/OWNERS
index e4bdca9e1..dbd09c611 100644
--- a/charts/partners/test467/dvdv/OWNERS
+++ b/charts/partners/test467/dvdv/OWNERS
@@ -1,7 +1,8 @@
 chart:
   name: dvdv
-  shortDescription: null
-publicPgpKey: null
+  shortDescription: unknown
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: rnargotr
 vendor:
diff --git a/charts/partners/vitagroupag/cdr-core-ehrbase-enterprise/OWNERS b/charts/partners/vitagroupag/cdr-core-ehrbase-enterprise/OWNERS
index 6bdf6556e..4379e7370 100644
--- a/charts/partners/vitagroupag/cdr-core-ehrbase-enterprise/OWNERS
+++ b/charts/partners/vitagroupag/cdr-core-ehrbase-enterprise/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: cdr-core-ehrbase-enterprise
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: false
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: bjoernpauli
 vendor:
diff --git a/charts/partners/vitagroupag/ehrbase/OWNERS b/charts/partners/vitagroupag/ehrbase/OWNERS
index abc8df2dc..baea044a9 100644
--- a/charts/partners/vitagroupag/ehrbase/OWNERS
+++ b/charts/partners/vitagroupag/ehrbase/OWNERS
@@ -1,8 +1,8 @@
 chart:
   name: ehrbase
-  shortDescription: null
+  shortDescription: unknown
 providerDelivery: true
-publicPgpKey: null
+publicPgpKey: unknown
 users:
 - githubUsername: bjoernpauli
 vendor:
diff --git a/charts/partners/voereir/ve-touchstone-master/5.1.0/report.yaml b/charts/partners/voereir/ve-touchstone-master/5.1.0/report.yaml
new file mode 100644
index 000000000..bcfb7cf0b
--- /dev/null
+++ b/charts/partners/voereir/ve-touchstone-master/5.1.0/report.yaml
@@ -0,0 +1,176 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: partner
+            version: v1.3
+        reportDigest: uint64:15201736724179206139
+        chart-uri: N/A
+        digests:
+            chart: sha256:f73c1f31935e17351fee30313cb95849a2d8a844e4ed759523a454cf6530a1e1
+            package: 99834cd9a72c709d664db7c5ab599b716628942987b74fd872e908505797d37b
+        lastCertifiedTimestamp: "2025-10-15T06:11:26.75522+00:00"
+        testedOpenShiftVersion: "4.19"
+        supportedOpenShiftVersions: '>=4.15'
+        webCatalogOnly: true
+    chart:
+        name: ve-touchstone-master
+        home: ""
+        sources: []
+        version: 5.1.0
+        description: A Helm chart for Deploying Touchstone Portal as well as Touchstone Management Portal End-to-End
+        keywords: []
+        maintainers:
+            - name: VoerEir AB
+              email: ""
+              url: https://github.com/VoerEirAB
+        icon: ""
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: v5.1.0
+        deprecated: false
+        annotations:
+            category: Touchstone
+            charts.openshift.io/name: Touchstone
+        kubeversion: '>=1.28.0-0'
+        dependencies:
+            - name: mysql
+              version: 10.3.0
+              repository: https://charts.bitnami.com/bitnami
+              condition: mysql.enabled
+              alias: mysql
+            - name: mongodb
+              version: 16.5.15
+              repository: https://charts.bitnami.com/bitnami
+              condition: mongodb.enabled
+              alias: mongodb
+            - name: redis
+              version: 19.3.3
+              repository: https://charts.bitnami.com/bitnami
+              condition: redis.enabled
+              alias: redis
+            - name: nginx-ingress-controller
+              version: 12.0.7
+              repository: https://charts.bitnami.com/bitnami
+              condition: ingress_nginx.enabled
+              alias: ingress_nginx
+            - name: ve-touchstone-db-helper
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_db_helper
+            - name: ve-touchstone-database-migration
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_database_upgrade
+            - name: ve-touchstone-api
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_api
+            - name: ve-touchstone-engine-observer
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_engine_observer
+            - name: ve-touchstone-web
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_web
+            - name: ve-touchstone-management-database-migration
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_management_database_upgrade
+            - name: ve-touchstone-management-backend
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_management_backend
+            - name: ve-touchstone-management-frontend
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_management_frontend
+            - name: ve-notification-dispatcher
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              condition: ve_notification_dispatcher.enabled
+              alias: ve_notification_dispatcher
+            - name: ve-touchstone-ui
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_ui
+            - name: ve-touchstone-ai
+              version: 5.1.0
+              repository: https://registry.voereir.io/chartrepo/voereir/
+              alias: ve_touchstone_ai
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-engine-init:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-engine:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-api:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-management-backend:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-ui:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-init-base:v1.0.0-ubi9
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-database-migration:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-rally-engine:3.2.0-T5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-notification-dispatcher:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-ai:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-management-frontend:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-web:v5.1.0
+        Image is Red Hat certified : registry.voereir.io/voereir/ve-touchstone-database-migration-init:v5.1.0
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
diff --git a/charts/partners/voereir/ve-touchstone-master/OWNERS b/charts/partners/voereir/ve-touchstone-master/OWNERS
new file mode 100644
index 000000000..af373ac52
--- /dev/null
+++ b/charts/partners/voereir/ve-touchstone-master/OWNERS
@@ -0,0 +1,10 @@
+chart:
+  name: ve-touchstone-master
+  shortDescription: unknown
+providerDelivery: true
+publicPgpKey: unknown
+users:
+- githubUsername: amitpd
+vendor:
+  label: voereir
+  name: VoerEir AB
diff --git a/charts/partners/wavefronthq/wavefront/OWNERS b/charts/partners/wavefronthq/wavefront/OWNERS
index 554af07d5..2db7359ae 100644
--- a/charts/partners/wavefronthq/wavefront/OWNERS
+++ b/charts/partners/wavefronthq/wavefront/OWNERS
@@ -2,7 +2,8 @@ chart:
   name: wavefront
   shortDescription: Deploys the Wavefront Collector for Kubernetes and Wavefront Proxy
     to your Kubernetes cluster
-publicPgpKey: null
+providerDelivery: false
+publicPgpKey: unknown
 users:
 - githubUsername: akodali18
 - githubUsername: johncornish
diff --git a/charts/partners/whiteklay/izac-helm-charts/OWNERS b/charts/partners/whiteklay/izac-helm-charts/OWNERS
index 1e4fe9c0a..978599093 100644
--- a/charts/partners/whiteklay/izac-helm-charts/OWNERS
+++ b/charts/partners/whiteklay/izac-helm-charts/OWNERS
@@ -7,4 +7,4 @@ users:
 - githubUsername: https://github.com/arjunkumar999/izacinstaller.git
 vendor:
   label: whiteklay
-  name: Whiteklay Pvt. Ltd.
+  name: Whiteklay
diff --git a/charts/partners/yugabytedb/ybhelm2/OWNERS b/charts/partners/yugabytedb/ybhelm2/OWNERS
index fcfb8a873..5cf7a9527 100644
--- a/charts/partners/yugabytedb/ybhelm2/OWNERS
+++ b/charts/partners/yugabytedb/ybhelm2/OWNERS
@@ -1,6 +1,7 @@
 chart:
   name: ybhelm2
   shortDescription: unknown
+providerDelivery: false
 publicPgpKey: unknown
 users: []
 vendor:
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/.helmignore b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/.helmignore
new file mode 100644
index 000000000..0e8a0eb36
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/Chart.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/Chart.yaml
new file mode 100644
index 000000000..1764b39f5
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/Chart.yaml
@@ -0,0 +1,46 @@
+apiVersion: v2
+name: redhat-cryostat
+description: Securely manage JFR recordings for your containerized Java workloads
+
+type: application
+
+version: "2.0.2"
+
+kubeVersion: ">= 1.25.0-0"
+
+appVersion: "4.0.2-redhat"
+
+home: "https://cryostat.io"
+
+icon: "https://raw.githubusercontent.com/cryostatio/cryostat-helm/main/docs/images/cryostat-icon.svg"
+
+annotations:
+  charts.openshift.io/archs: x86_64, aarch64
+  charts.openshift.io/name: Red Hat build of Cryostat
+  charts.openshift.io/provider: Red Hat
+  charts.openshift.io/supportURL: https://github.com/cryostatio/cryostat-helm
+
+keywords:
+- flightrecorder
+- java
+- jdk
+- jfr
+- jmc
+- missioncontrol
+- monitoring
+- profiling
+- diagnostic
+
+sources:
+- https://github.com/cryostatio/cryostat
+- https://github.com/cryostatio/cryostat-core
+- https://github.com/cryostatio/cryostat-web
+- https://github.com/cryostatio/jfr-datasource
+- https://github.com/cryostatio/cryostat-grafana-dashboard
+- https://github.com/cryostatio/cryostat-db
+- https://github.com/cryostatio/cryostat-storage
+- https://github.com/cryostatio/openshift-oauth-proxy
+
+maintainers:
+- name: The Cryostat Community
+  url: https://groups.google.com/g/cryostat-development
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/LICENSE b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/LICENSE
new file mode 100644
index 000000000..57bc88a15
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/LICENSE
@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/README.md b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/README.md
new file mode 100644
index 000000000..4533f18b1
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/README.md
@@ -0,0 +1,274 @@
+# Cryostat Helm Chart
+
+![Version: 2.0.0-dev](https://img.shields.io/badge/Version-2.0.0--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 4.0.0-dev](https://img.shields.io/badge/AppVersion-4.0.0--dev-informational?style=flat-square)
+
+A Helm chart for deploying [Cryostat](https://cryostat.io/) on Kubernetes and OpenShift.
+
+## Requirements
+
+Kubernetes: `>= 1.25.0-0`
+
+## Installation
+
+### From Helm repository
+
+The chart is available at the following repositories:
+
+- https://cryostat.io/helm-charts
+- https://charts.openshift.io
+
+To install the chart, add the repository and install, for example:
+
+```bash
+helm repo add cryostat-charts https://cryostat.io/helm-charts
+helm repo update
+helm install cryostat cryostat-charts/cryostat
+```
+
+### From OCI container registry
+
+The chart is also available as an OCI image on GitHub Container Registry (`ghcr.io`).
+
+To install the chart, run:
+
+```bash
+helm install cryostat oci://ghcr.io/cryostatio/cryostat-helm --version $VERSION
+```
+
+### From source code
+
+To install the chart from source code, run:
+
+```bash
+git clone https://github.com/cryostatio/cryostat-helm
+cd cryostat-helm
+helm install cryostat ./charts/cryostat
+```
+
+## Configuration
+
+See the sections below for Helm chart values which can be used for configuring various aspects of the Cryostat installation.
+
+If there are further customizations required to suit your deployment environment, choose the settings values that get
+you closest to what you need, then manually edit the resulting Kubernetes objects to suit your requirements. You may
+also consider using `helm install --dry-run` to render the Kubernetes YAML manifests without installing them, so that
+you can apply your own customization patches as needed.
+
+### TLS
+
+When installed on OpenShift with `authentication.openshift.enabled=true`, the cluster's
+["service serving certificates"](https://docs.openshift.com/container-platform/4.17/security/certificates/service-serving-certificate.html)
+feature is used to enable managed TLS configuration on the exposed HTTP(S) ports.
+
+When installed with `authentication.openshift.enabled=false` but `oauth2Proxy.tls.selfSigned.enabled=true` then a
+self-signed TLS certificate will be generated at installation time to serve similar purposes. These TLS certificates
+are not managed, will not automatically rotate, and will expire after 365 days. You will need to manually rotate the
+certificates, or reinstall the chart, or else apply your own customizations to the Kubernetes manifests to automate TLS
+certificate issuance and rotation.
+
+## Parameters
+
+### Cryostat Container
+
+| Name                                                   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Value                                        |
+| ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
+| `core`                                                 | Configuration for the core Cryostat application                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                              |
+| `core.image.repository`                                | Repository for the main Cryostat container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `registry.redhat.io/cryostat/cryostat-rhel9` |
+| `core.image.pullPolicy`                                | Image pull policy for the main Cryostat container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `IfNotPresent`                               |
+| `core.image.tag`                                       | Tag for the main Cryostat container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `4.0.2`                                      |
+| `core.podAnnotations`                                  | Annotations to be applied to the Cryostat Pods                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                         |
+| `core.service.type`                                    | Type of Service to create for the Cryostat application                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `ClusterIP`                                  |
+| `core.service.httpPort`                                | Port number to expose on the Service for Cryostat's HTTP server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `8181`                                       |
+| `core.debug.log.level`                                 | Log level for troubleshooting and debugging                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `INFO`                                       |
+| `core.sslProxied`                                      | Enables SSL Proxied Environment Variables, useful when you are offloading SSL/TLS at External Loadbalancer instead of Ingress                                                                                                                                                                                                                                                                                                                                                                                                                  | `false`                                      |
+| `core.ingress.enabled`                                 | Whether to create an Ingress object for the Cryostat service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                                      |
+| `core.ingress.className`                               | Ingress class name for the Cryostat application Ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `""`                                         |
+| `core.ingress.annotations`                             | Annotations to apply to the Cryostat application Ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `{}`                                         |
+| `core.ingress.hosts`                                   | Hosts to create rules for in the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)                                                                                                                                                                                                                                                                                                                                                               | `[]`                                         |
+| `core.ingress.tls`                                     | TLS configuration for the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                         |
+| `core.route.enabled`                                   | Whether to create a Route object for the Cryostat service. Available only on OpenShift                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `true`                                       |
+| `core.route.tls.enabled`                               | Whether to secure the Cryostat application Route with TLS. See: [TLSConfig](https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/route-route-openshift-io-v1.html#spec-tls)                                                                                                                                                                                                                                                                                                                                                | `true`                                       |
+| `core.route.tls.termination`                           | Type of TLS termination to use for the Cryostat application Route. One of: `edge`, `passthrough`, `reencrypt`                                                                                                                                                                                                                                                                                                                                                                                                                                  | `edge`                                       |
+| `core.route.tls.insecureEdgeTerminationPolicy`         | Specify how to handle insecure traffic for the Cryostat application Route. One of: `Allow`, `Disable`, `Redirect`                                                                                                                                                                                                                                                                                                                                                                                                                              | `Redirect`                                   |
+| `core.route.tls.key`                                   | Custom private key to use when securing the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `""`                                         |
+| `core.route.tls.certificate`                           | Custom certificate to use when securing the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `""`                                         |
+| `core.route.tls.caCertificate`                         | Custom CA certificate to use, if needed to complete the certificate chain, when securing the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                                        | `""`                                         |
+| `core.route.tls.destinationCACertificate`              | Provides the contents of the CA certificate of the final destination when using reencrypt termination for the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                       | `""`                                         |
+| `core.resources.requests.cpu`                          | CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                                                                                                                                                                                                                                                         | `500m`                                       |
+| `core.resources.requests.memory`                       | Memory resource request for the Cryostat container.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `384Mi`                                      |
+| `core.securityContext`                                 | Security Context for the Cryostat container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)                                                                                                                                                                                                                                 | `{}`                                         |
+| `core.databaseSecretName`                              | Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data stored within the database, such as the target credentials keyring. It must not be updated across chart upgrades. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                                         |
+| `core.discovery`                                       | Configuration options to the Cryostat application's target discovery mechanisms                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                              |
+| `core.discovery.kubernetes.enabled`                    | Enables Kubernetes API discovery mechanism                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `true`                                       |
+| `core.discovery.kubernetes.installNamespaceDisabled`   | When false and `namespaces` is empty, the Cryostat application will default to discovery targets in the install namespace (i.e. `{{ .Release.Namespace }}`)                                                                                                                                                                                                                                                                                                                                                                                    | `false`                                      |
+| `core.discovery.kubernetes.namespaces`                 | List of namespaces whose workloads the Cryostat application should be permitted to access and profile                                                                                                                                                                                                                                                                                                                                                                                                                                          | `[]`                                         |
+| `core.discovery.kubernetes.builtInPortNamesDisabled`   | When false and `portNames` is empty, the Cryostat application will use the default port name `jfr-jmx` to look for JMX connectable targets.                                                                                                                                                                                                                                                                                                                                                                                                    | `false`                                      |
+| `core.discovery.kubernetes.portNames`                  | List of port names that the Cryostat application should look for in order to consider a target as JMX connectable                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                         |
+| `core.discovery.kubernetes.builtInPortNumbersDisabled` | When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                                      |
+| `core.discovery.kubernetes.portNumbers`                | List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable                                                                                                                                                                                                                                                                                                                                                                                                                            | `[]`                                         |
+| `core.config.eventTemplates.configMapNames`            | List of ConfigMap names. Each ConfigMap is expected to contain one or more files, which are .jfc (XML) JFR Event Templates, to be mounted to the Cryostat container.                                                                                                                                                                                                                                                                                                                                                                           | `[]`                                         |
+| `core.config.tlsTruststore.secretNames`                | List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.                                                                                                                                                                                                                                                                                                                | `[]`                                         |
+| `core.nodeSelector`                                    | Node Selector for the Cryostat Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                             | `{}`                                         |
+| `core.tolerations`                                     | Tolerations for the Cryostat Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                         |
+| `core.affinity`                                        | Affinity for the Cryostat Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                         |
+
+### Report Generator Deployment
+
+| Name                                | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Value                                                |
+| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| `reports`                           | Configuration for the Reports Generator deployment                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                      |
+| `reports.image.repository`          | Repository for the Report Generator container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `registry.redhat.io/cryostat/cryostat-reports-rhel9` |
+| `reports.image.pullPolicy`          | Image pull policy for the Report Generator container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `IfNotPresent`                                       |
+| `reports.image.tag`                 | Tag for the Report Generator image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `4.0.2`                                              |
+| `reports.podAnnotations`            | Annotations to be applied to the Report Generator Pods                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                 |
+| `reports.service.type`              | Type of Service to create for the Report Generator Deployment                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `ClusterIP`                                          |
+| `reports.service.httpPort`          | Port number to expose on the Service for the Report Generator Deployment                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `10001`                                              |
+| `reports.reportsSecretName`         | Name of the secret containing the report generator access keys. This secret must contain a REPORTS_PASS secret which is the secret credential for the report generators. It must not be updated across chart upgrades, or else the connection between Cryostat and report generators will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                                                 |
+| `reports.debug.log.level`           | Log level for troubleshooting and debugging                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `INFO`                                               |
+| `reports.replicas`                  | Number of Report Generator replicas to deploy. If zero, the Deployment and Service will not be created and the main Cryostat container will handle all report generations on its own.                                                                                                                                                                                                                                                                                                                                       | `0`                                                  |
+| `reports.resources.requests.cpu`    | CPU resource request for each Pod in the Report Generator Deployment.                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `500m`                                               |
+| `reports.resources.requests.memory` | Memory resource request for each Pod in the Report Generator Deployment.                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `512Mi`                                              |
+| `reports.securityContext`           | Security Context for the Report Generator containers. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)                                                                                                                                                                                                     | `{}`                                                 |
+| `reports.nodeSelector`              | Node Selector for the Report Generator Pods. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                 |
+| `reports.tolerations`               | Tolerations for the Report Generator Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                    | `[]`                                                 |
+| `reports.affinity`                  | Affinity for the Report Generator Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                          | `{}`                                                 |
+
+### Database Container
+
+| Name                           | Description                                                                                                                                                                                                                                                                                                    | Value                                           |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
+| `db`                           | Configuration for Cryostat's database                                                                                                                                                                                                                                                                          |                                                 |
+| `db.image.repository`          | Repository for the database container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/cryostat-db-rhel9` |
+| `db.image.pullPolicy`          | Image pull policy for the database container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                  |
+| `db.image.tag`                 | Tag for the database container image                                                                                                                                                                                                                                                                           | `4.0.2`                                         |
+| `db.podAnnotations`            | Annotations to be applied to the Database Pods                                                                                                                                                                                                                                                                 | `{}`                                            |
+| `db.service.type`              | Type of Service to create for the database                                                                                                                                                                                                                                                                     | `ClusterIP`                                     |
+| `db.service.port`              | Port number to expose on the Service                                                                                                                                                                                                                                                                           | `5432`                                          |
+| `db.resources.requests.cpu`    | CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                         | `25m`                                           |
+| `db.resources.requests.memory` | Memory resource request for the database container.                                                                                                                                                                                                                                                            | `64Mi`                                          |
+| `db.pvc.enabled`               | Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.                                                                                                                        | `false`                                         |
+| `db.pvc.annotations`           | Annotations to add to the persistentVolumeClaim                                                                                                                                                                                                                                                                | `{}`                                            |
+| `db.pvc.storage`               | Storage size to request for the persistentVolumeClaim                                                                                                                                                                                                                                                          | `500Mi`                                         |
+| `db.pvc.accessModes`           | Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                         | `["ReadWriteOnce"]`                             |
+| `db.pvc.selector`              | Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                | `{}`                                            |
+| `db.pvc.storageClassName`      | The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                               | `undefined`                                     |
+| `db.securityContext`           | Security Context for the database container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                            |
+| `db.nodeSelector`              | Node Selector for the Database Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                             | `{}`                                            |
+| `db.tolerations`               | Tolerations for the Database Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                | `[]`                                            |
+| `db.affinity`                  | Affinity for the Database Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                      | `{}`                                            |
+
+### Storage Container
+
+| Name                                | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Value                                                |
+| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| `storage`                           | Configuration for Cryostat's object storage provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                      |
+| `storage.storageSecretName`         | Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                                                 |
+| `storage.image.repository`          | Repository for the storage container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `registry.redhat.io/cryostat/cryostat-storage-rhel9` |
+| `storage.image.pullPolicy`          | Image pull policy for the storage container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `IfNotPresent`                                       |
+| `storage.image.tag`                 | Tag for the storage container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `4.0.2`                                              |
+| `storage.encryption.enabled`        | Enable at-rest encryption of stored objects. The storage container will generate a secret key for each stored object and use this key to encrypt and decrypt objects transparently. The key is written to the object metadata, so in the default storage container configuration this only adds a small layer of additional security.                                                                                                                                                                                              | `true`                                               |
+| `storage.podAnnotations`            | Annotations to be applied to the Storage Pods                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                 |
+| `storage.service.type`              | Type of Service to create for the object storage                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `ClusterIP`                                          |
+| `storage.service.port`              | Port number to expose on the Service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `8333`                                               |
+| `storage.resources.requests.cpu`    | CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                                                                                                                                                                                                                                       | `50m`                                                |
+| `storage.resources.requests.memory` | Memory resource request for the object storage container.                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `256Mi`                                              |
+| `storage.pvc.enabled`               | Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.                                                                                                                                                                                                                                                                                                                                            | `false`                                              |
+| `storage.pvc.annotations`           | Annotations to add to the persistentVolumeClaim                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `{}`                                                 |
+| `storage.pvc.storage`               | Storage size to request for the persistentVolumeClaim                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `500Mi`                                              |
+| `storage.pvc.accessModes`           | Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                                                                                                                                                                                                                             | `["ReadWriteOnce"]`                                  |
+| `storage.pvc.selector`              | Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                                                                                                                                                                                                                                    | `{}`                                                 |
+| `storage.pvc.storageClassName`      | The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                                                                                                                                                                                                                   | `undefined`                                          |
+| `storage.securityContext`           | Security Context for the storage container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)                                                                                                                                                                                                                      | `{}`                                                 |
+| `storage.nodeSelector`              | Node Selector for the Storage Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                  | `{}`                                                 |
+| `storage.tolerations`               | Tolerations for the Storage Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                                 |
+| `storage.affinity`                  | Affinity for the Storage Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                           | `{}`                                                 |
+
+### Grafana Container
+
+| Name                                | Description                                                                                                                                                                                                                                                                                                   | Value                                                          |
+| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `grafana`                           | Configuration for the customized Grafana instance for Cryostat                                                                                                                                                                                                                                                |                                                                |
+| `grafana.image.repository`          | Repository for the Grafana container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9` |
+| `grafana.image.pullPolicy`          | Image pull policy for the Grafana container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                                 |
+| `grafana.image.tag`                 | Tag for the Grafana container image                                                                                                                                                                                                                                                                           | `4.0.2`                                                        |
+| `grafana.service.type`              | Type of Service to create for Grafana                                                                                                                                                                                                                                                                         | `ClusterIP`                                                    |
+| `grafana.service.port`              | Port number to expose on the Service for Grafana's HTTP server                                                                                                                                                                                                                                                | `3000`                                                         |
+| `grafana.resources.requests.cpu`    | CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                         | `25m`                                                          |
+| `grafana.resources.requests.memory` | Memory resource request for the Grafana container.                                                                                                                                                                                                                                                            | `80Mi`                                                         |
+| `grafana.securityContext`           | Security Context for the Grafana container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                                           |
+| `grafana.nodeSelector`              | Node Selector for the Grafana Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                             | `{}`                                                           |
+| `grafana.tolerations`               | Tolerations for the Grafana Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                | `[]`                                                           |
+
+### JFR Data Source Container
+
+| Name                                   | Description                                                                                                                                                                                                                                                                                                           | Value                                              |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| `datasource`                           | Configuration for the JFR Data Source component, which translates recording events into a format consumable by Grafana                                                                                                                                                                                                |                                                    |
+| `datasource.image.repository`          | Repository for the JFR Data Source container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/jfr-datasource-rhel9` |
+| `datasource.image.pullPolicy`          | Image pull policy for the JFR Data Source container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                     |
+| `datasource.image.tag`                 | Tag for the JFR Data Source container image                                                                                                                                                                                                                                                                           | `4.0.2`                                            |
+| `datasource.resources.requests.cpu`    | CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                         | `200m`                                             |
+| `datasource.resources.requests.memory` | Memory resource request for the JFR Data Source container.                                                                                                                                                                                                                                                            | `200Mi`                                            |
+| `datasource.securityContext`           | Security Context for the JFR Data Source container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                               |
+| `datasource.nodeSelector`              | Node Selector for the JFR Datasource Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                              | `{}`                                               |
+| `datasource.tolerations`               | Tolerations for the JFR Datasource Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                 | `[]`                                               |
+
+### Authentication
+
+| Name                                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Value                   |
+| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
+| `authentication.cookieSecretName`           | Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                    |
+| `authentication.openshift.enabled`          | Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.                                                                                                                                                                                                                                                                                                                                  | `true`                  |
+| `authentication.openshift.clusterRole.name` | The name of the ClusterRole to bind for the OpenShift OAuth Proxy                                                                                                                                                                                                                                                                                                                                                                                                                | `system:auth-delegator` |
+| `authentication.basicAuth.enabled`          | Whether Cryostat should use basic authentication for users. When false, Cryostat will not perform any form of authentication                                                                                                                                                                                                                                                                                                                                                     | `false`                 |
+| `authentication.basicAuth.secretName`       | Name of the Secret that contains the credentials within Cryostat's namespace **(Required if basicAuth is enabled)**                                                                                                                                                                                                                                                                                                                                                              | `""`                    |
+| `authentication.basicAuth.filename`         | Key within Secret containing the `htpasswd` file. The file should contain one user definition entry per line, with the syntax "user:passHash", where "user" is the username and "passHash" is the `bcrypt` hash of the desired password. Such an entry can be generated with ex. `htpasswd -nbB username password` **(Required if basicAuth is enabled)**                                                                                                                        | `""`                    |
+
+### OAuth2 Proxy
+
+| Name                                    | Description                                                                                                                                                                                                                                                                                                         | Value   |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `oauth2Proxy.image.repository`          | Repository for the OAuth2 Proxy container image                                                                                                                                                                                                                                                                     | `""`    |
+| `oauth2Proxy.image.pullPolicy`          | Image pull policy for the OAuth2 Proxy container image                                                                                                                                                                                                                                                              | `Never` |
+| `oauth2Proxy.image.tag`                 | Tag for the OAuth2 Proxy container image                                                                                                                                                                                                                                                                            | `""`    |
+| `oauth2Proxy.tls.selfSigned.enabled`    | Whether a self-signed TLS certificate for oauth2-proxy HTTPS is generated and used.                                                                                                                                                                                                                                 | `false` |
+| `oauth2Proxy.resources.requests.cpu`    | CPU resource request for the OAuth2 Proxy container.                                                                                                                                                                                                                                                                | `25m`   |
+| `oauth2Proxy.resources.requests.memory` | Memory resource request for the OAuth2 Proxy container.                                                                                                                                                                                                                                                             | `64Mi`  |
+| `oauth2Proxy.securityContext`           | Security Context for the OAuth2 Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1). | `{}`    |
+
+### OpenShift OAuth Proxy
+
+| Name                                            | Description                                                                                                                                                                                                                                                                                                                 | Value                                                        |
+| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| `openshiftOauthProxy.image.repository`          | Repository for the OpenShift OAuth Proxy container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9` |
+| `openshiftOauthProxy.image.pullPolicy`          | Image pull policy for the OpenShift OAuth Proxy container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                               |
+| `openshiftOauthProxy.image.tag`                 | Tag for the OpenShift OAuth Proxy container image                                                                                                                                                                                                                                                                           | `4.0.2`                                                      |
+| `openshiftOauthProxy.resources.requests.cpu`    | CPU resource request for the OpenShift OAuth Proxy container.                                                                                                                                                                                                                                                               | `25m`                                                        |
+| `openshiftOauthProxy.resources.requests.memory` | Memory resource request for the OpenShift OAuth Proxy container.                                                                                                                                                                                                                                                            | `64Mi`                                                       |
+| `openshiftOauthProxy.accessReview.enabled`      | Whether the SubjectAccessReview/TokenAccessReview role checks for users and clients are enabled. If this is disabled then the proxy will only check that the user has valid credentials or holds a valid token.                                                                                                             | `true`                                                       |
+| `openshiftOauthProxy.accessReview.group`        | The OpenShift resource group that the SubjectAccessReview/TokenAccessReview will be performed for. See https://github.com/openshift/oauth-proxy/?tab=readme-ov-file#delegate-authentication-and-authorization-to-openshift-for-infrastructure                                                                               | `""`                                                         |
+| `openshiftOauthProxy.accessReview.resource`     | The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                                | `pods`                                                       |
+| `openshiftOauthProxy.accessReview.subresource`  | The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                                | `exec`                                                       |
+| `openshiftOauthProxy.accessReview.name`         | The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                           | `""`                                                         |
+| `openshiftOauthProxy.accessReview.namespace`    | The OpenShift namespace that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                               | `{{ .Release.Namespace }}`                                   |
+| `openshiftOauthProxy.accessReview.verb`         | The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                           | `create`                                                     |
+| `openshiftOauthProxy.accessReview.version`      | The OpenShift resource version that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                        | `""`                                                         |
+| `openshiftOauthProxy.securityContext`           | Security Context for the OpenShift OAuth Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                                         |
+
+### Other Parameters
+
+| Name                            | Description                                                                                                                                                                                                                                                                                               | Value  |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
+| `imagePullSecrets`              | Image pull secrets to be used for the Cryostat deployment                                                                                                                                                                                                                                                 | `[]`   |
+| `nameOverride`                  | Overrides the name of this Chart                                                                                                                                                                                                                                                                          | `""`   |
+| `fullnameOverride`              | Overrides the fully qualified application name of `[release name]-[chart name]`                                                                                                                                                                                                                           | `""`   |
+| `rbac.create`                   | Specifies whether RBAC resources should be created                                                                                                                                                                                                                                                        | `true` |
+| `serviceAccount.create`         | Specifies whether a service account should be created                                                                                                                                                                                                                                                     | `true` |
+| `serviceAccount.annotations`    | Annotations to add to the service account                                                                                                                                                                                                                                                                 | `{}`   |
+| `serviceAccount.name`           | The name of the service account to use. If not set and create is true, a name is generated using the fullname template                                                                                                                                                                                    | `""`   |
+| `podAnnotations`                | Annotations to be applied to the various Pods                                                                                                                                                                                                                                                             | `{}`   |
+| `podSecurityContext`            | Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}`   |
+| `networkPolicy.ingress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.                                  | `true` |
+| `nodeSelector`                  | default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                           | `{}`   |
+| `tolerations`                   | default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                   | `[]`   |
+| `affinity`                      | default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                         | `{}`   |
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/TESTING.md b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/TESTING.md
new file mode 100644
index 000000000..ff9fb3beb
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/TESTING.md
@@ -0,0 +1,148 @@
+# Testing Guide for Cryostat Helm Chart
+
+This guide outlines the conventions and practices for writing and executing tests in the Cryostat Helm chart project using the Helm Unittest plugin.
+
+## Overview
+
+Helm Unittest is a Helm plugin that allows to write declarative tests for Helm charts. It enables testing the rendered templates of a Helm chart with specified values without the need for any running Kubernetes cluster.
+
+# Testing Guide for Cryostat Helm Chart
+
+## Requirements
+
+Before running tests, you need to have the following tools installed:
+
+- **Helm:** Helm is a package manager for Kubernetes needed to manage the charts.
+  `Required version: >= v3.14.4`
+- **Helm Unittest Plugin:** This plugin enables unit testing for Helm charts.
+  `Required version: >= v0.5.1`
+
+## Installation
+
+##### Installing Helm
+
+Helm can be installed on a variety of platforms. [Official Helm installation documentation](https://helm.sh/docs/intro/install/) provides detailed instructions.
+
+##### Installing Helm Unittest Plugin
+
+Once Helm is installed, you can install the Helm Unittest plugin.
+First, verify whether the Helm Unittest plugin has been successfully installed, you can use the following command to list all installed Helm plugins:
+```bash
+helm plugin list
+```
+This command will display a list of all plugins currently installed in your Helm environment, including the Helm Unittest plugin if it's already installed. Look for an entry named unittest in the output. If it's listed, then the Helm Unittest plugin is installed correctly. For example:
+```
+❯ helm plugin list
+
+NAME    	VERSION	DESCRIPTION
+unittest	0.5.1  	Unit test for helm chart in YAML with ease
+to keep your chart functional and robust.
+```
+If the Helm Unittest plugin is not listed, you can install it using the following command:
+```bash
+$ helm plugin install https://github.com/helm-unittest/helm-unittest.git
+```
+This will install the latest version of binary into helm plugin directory.
+
+## Writing Tests
+
+Each test is associated with a specific Helm template and is structured to validate specific aspects of that template. Here's a general structure for writing tests:
+
+1. **Test Suite:** A collection of tests related to a particular aspect of the chart, usually corresponding to a specific template file.
+2. **Test Cases:** Each test case should focus on a single aspect or feature of the chart. Test cases can have different configurations set through the `set` directive to simulate different environments or scenarios.
+3. **Assertions:** Test cases contain assertions that specify the expected output of the rendered templates. Assertions can check for the existence of objects, equality of values, matching patterns, and more.
+
+##### Naming Conventions for Test Files
+The naming convention for test files typically mirrors the name of the template they are testing with a `_test` suffix. For example:
+
+- service.yaml ➔ service_test.yaml
+- deployment.yaml ➔ deployment_test.yaml
+
+## Directory Structure
+
+Tests are organized under the `tests/` directory, with each test file corresponding to a template in the `templates/` directory:
+
+```plaintext
+cryostat-helm/
+├── charts
+│   └── cryostat
+│       ├── Chart.yaml
+│       ├── templates
+│       │   ├── alpha_config.yaml
+│       │   ├── ...
+│       │   └── tests
+│       │       ├── test-core-connection.yaml
+│       │       └── ...
+│       ├── TESTING.md
+│       ├── tests
+│       │   ├── alpha_config_test.yaml
+│       │   ├── ...
+│       │   ├── __snapshot__
+│       │   └── storage_access_secret_test.yaml
+│       ├── values.schema.json
+│       └── values.yaml
+
+```
+In addition, Cryostat Helm chart includes integration tests located in the `templates/tests` directory and are executed using `helm test`. These tests are different from unit tests in that they involve actual deployment of resources to a Kubernetes cluster to validate the integrated operation of those resources.
+
+## Test File Structure
+
+Here's an example of what a test file looks like:
+
+```yaml
+suite: <Name of Test Suite>
+templates:
+  - <path to template from chart root>
+tests:
+  - it: <description of what the test does>
+    set:
+      <values to be set>
+    asserts:
+      - <assert type>:
+          path: <path to value to test>
+          value: <expected value>
+```
+## Common Assertions
+- `equal`: Checks if the actual value at path equals the expected value.
+- `matchRegex`: Validates if the actual string matches the given regex pattern.
+- `exists`: Checks if the specified path exists in the document.
+- `notExists`: Ensures the specified path does not exist in the document.
+
+Visit [this document](https://github.com/helm-unittest/helm-unittest/blob/main/DOCUMENT.md#assertion-types) for more assertion types.
+## Running Tests
+
+Once Unittest plugin has been installed, tests can be executed by running the following command:
+```bash
+$ helm unittest <path-to-chart-directory>
+```
+In the case of `cryostat-helm`, the command would be:
+
+```bash
+$ helm unittest ./charts/cryostat
+```
+To run test for a specific test file, use the `-f` flag with helm unittest to specify the test file to be executed. Here's the command format:
+
+```bash
+$ helm unittest -f tests/<testfile>.yaml ./charts/<chartname>
+```
+This command will run the test for `service_test.yaml` file:
+
+```bash
+$ helm unittest -f tests/service_test.yaml ./charts/cryostat
+```
+## Additional Resources and Documentation
+
+For more infomation on Helm and writing tests for Helm charts, the following resources can be invaluable:
+
+### Helm Documentation
+
+- **Helm Official Documentation:** Provides comprehensive guides, tutorials, and reference material for working with Helm.
+  [Helm Documentation](https://helm.sh/docs/)
+
+- **Helm Chart Best Practices:** A guide by the Helm community outlining best practices for creating and managing Helm charts.
+  [Helm Chart Best Practices](https://helm.sh/docs/chart_best_practices/)
+
+### Helm Unittest Plugin
+
+- **Helm Unittest GitHub Repository:** Contains the source code, installation instructions, and detailed usage examples of the Helm Unittest plugin.
+  [Helm Unittest on GitHub](https://github.com/helm-unittest/helm-unittest)
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/release-notes.md b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/release-notes.md
new file mode 100644
index 000000000..99ccb509e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/release-notes.md
@@ -0,0 +1 @@
+<!-- Release notes generated using configuration in .github/release.yml -->
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/NOTES.txt b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/NOTES.txt
new file mode 100644
index 000000000..595f10117
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/NOTES.txt
@@ -0,0 +1,64 @@
+{{- $envVars := list }}
+{{- $portForwards := false }}
+{{- $listNum := 1 }}
+{{- if not .Values.core.ingress.enabled }}
+{{ $listNum }}. Configure the application to serve external traffic:
+{{- $listNum = add1 $listNum }}
+  ```
+{{- if .Values.core.route.enabled }}
+{{- /* Do nothing */}}
+  No actions required with this configuration.
+{{- else if .Values.core.ingress.enabled }}
+{{- /* Do nothing */}}
+  No actions required with this configuration.
+{{- else if contains "ClusterIP" .Values.core.service.type }}
+  {{- /* Do nothing */}}
+  No actions required with this configuration.
+{{- $portForwards = true }}
+{{- else if contains "NodePort" .Values.core.service.type }}
+  export NODE_IP=$(oc get nodes -n {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(oc get -n {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "cryostat.fullname" . }})
+{{- $envVars = list "QUARKUS_HTTP_HOST=$NODE_IP" }}
+{{- else if contains "LoadBalancer" .Values.core.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status by running 'oc get -n {{ .Release.Namespace }} -w svc/{{ include "cryostat.fullname" . }}'
+  export SERVICE_IP=$(oc get svc -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+{{- $envVars = list "QUARKUS_HTTP_HOST=$SERVICE_IP" }}
+{{- end }}
+
+{{- if not (empty $envVars) }}
+  oc -n {{ .Release.Namespace }} set env deploy --containers={{ .Chart.Name }} {{ include "cryostat.deploymentName" . }} {{ join " " $envVars }}
+{{- end }}
+  ```
+{{- end }}
+
+{{- if $portForwards }}
+
+{{ $listNum }}. Forward local port to the application's service:
+  ```
+  oc -n {{ .Release.Namespace }} wait --for=condition=available --timeout=60s deploy/{{ include "cryostat.deploymentName" . }}
+
+  export SVC_NAME=$(oc get services -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "cryostat.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=cryostat" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
+  oc -n {{ .Release.Namespace }} port-forward svc/$SVC_NAME {{ include "cryostat.core.service.port" . }}:{{ include "cryostat.core.service.scheme" . }}
+  ```
+  {{- $listNum = add1 $listNum }}
+{{- end }}
+
+{{ $listNum }}. Visit the application at:
+  ```
+{{- if .Values.core.route.enabled }}
+  echo {{ ternary "https" "http" .Values.core.route.tls.enabled }}://$(oc get route -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }} -o jsonpath="{.status.ingress[0].host}")
+{{- else if .Values.core.ingress.enabled }}
+{{- range $host := .Values.core.ingress.hosts -}}
+  {{- range .paths }}
+  {{ ternary "http" "https" (empty $.Values.core.ingress.tls) }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.core.service.type }}
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.core.service.type }}
+  echo http://$SERVICE_IP:{{ .Values.core.service.httpPort }}
+{{- else if contains "ClusterIP" .Values.core.service.type }}
+  {{ include "cryostat.core.service.scheme" . }}://localhost:{{ include "cryostat.core.service.port" . }}
+{{- end }}
+  ```
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_helpers.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_helpers.tpl
new file mode 100644
index 000000000..0a8e7e522
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_helpers.tpl
@@ -0,0 +1,195 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cryostat.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cryostat.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cryostat.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels.
+*/}}
+{{- define "cryostat.labels" -}}
+helm.sh/chart: {{ include "cryostat.chart" . }}
+{{ include "cryostat.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels.
+*/}}
+{{- define "cryostat.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cryostat.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: cryostat
+{{- end }}
+
+{{/*
+Create the name of the service account to use.
+*/}}
+{{- define "cryostat.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cryostat.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Cryostat service TLS enablement. Returns the string values "true" or "false".
+*/}}
+{{- define "cryostat.core.service.tls" -}}
+{{ or .Values.authentication.openshift.enabled .Values.oauth2Proxy.tls.selfSigned.enabled }}
+{{- end }}
+
+{{/*
+Cryostat service protocol. HTTPS if TLS is enabled, HTTP otherwise.
+*/}}
+{{- define "cryostat.core.service.scheme" -}}
+{{ ternary "https" "http" ( include "cryostat.core.service.tls" . | eq "true" ) }}
+{{- end }}
+
+{{/*
+Cryostat service port. 8443 if TLS is enabled, 8080 otherwise.
+*/}}
+{{- define "cryostat.core.service.port" -}}
+{{ ternary 8443 8080 ( ( include "cryostat.core.service.scheme" . ) | eq "https" ) }}
+{{- end }}
+
+{{/*
+Get or generate a default connection key for database.
+*/}}
+{{- define "cryostat.databaseConnectionKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-db" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current key. Do not regenerate.
+*/}}
+{{- $secret.data.CONNECTION_KEY -}}
+{{- else -}}
+{{/*
+    Generate new key.
+*/}}
+{{- (randAlphaNum 32) | b64enc | quote -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default encryption key for database.
+*/}}
+{{- define "cryostat.databaseEncryptionKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-db" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current key. Do not regenerate.
+*/}}
+{{- $secret.data.ENCRYPTION_KEY -}}
+{{- else -}}
+{{/*
+    Generate new key
+*/}}
+{{- (randAlphaNum 32) | b64enc | quote -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default secret key for object storage.
+*/}}
+{{- define "cryostat.objectStorageSecretKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-storage-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current secret. Do not regenerate.
+*/}}
+{{- $secret.data.STORAGE_ACCESS_KEY -}}
+{{- else -}}
+{{/*
+    Generate new secret
+*/}}
+{{- (randAlphaNum 32) | b64enc | quote -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default secret password key for report generators.
+*/}}
+{{- define "cryostat.reportsPassSecretKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-reports-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current secret. Do not regenerate.
+*/}}
+{{- $secret.data.REPORTS_PASS -}}
+{{- else -}}
+{{/*
+    Generate new secret
+*/}}
+{{- (randAlphaNum 32) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default secret key for auth proxy cookies.
+*/}}
+{{- define "cryostat.cookieSecret" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-cookie-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current secret. Do not regenerate.
+*/}}
+{{- $secret.data.COOKIE_SECRET -}}
+{{- else -}}
+{{/*
+    Generate new secret
+*/}}
+{{- (randAlphaNum 32) | b64enc -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+    Get sanitized list or defaults (if not disabled) as comma-separated list.
+*/}}
+{{- define "cryostat.commaSepList" -}}
+{{- $l := index . 0 -}}
+{{- $default := index . 1 -}}
+{{- $disableDefaults := index . 2 -}}
+{{- if and (not $l) (not $disableDefaults) -}}
+{{- $l = list $default -}}
+{{- end -}}
+{{- join "," (default list $l | compact | uniq) | quote -}}
+{{- end -}}
+
+{{/*
+Get the name for managed deployments.
+*/}}
+{{- define "cryostat.deploymentName" -}}
+{{- $version := semver .Chart.AppVersion -}}
+{{- printf "%s-v%d" (include "cryostat.fullname" .) $version.Major -}}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_oauth2Proxy.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_oauth2Proxy.tpl
new file mode 100644
index 000000000..db3fc6b90
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_oauth2Proxy.tpl
@@ -0,0 +1,54 @@
+{{/*
+Create OAuth2 Proxy container. Configurations defined in alpha_config.yaml
+*/}}
+{{- define "cryostat.oauth2Proxy" -}}
+- name: {{ printf "%s-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml (.Values.oauth2Proxy).securityContext | nindent 4 }}
+  image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
+  args:
+    - "--alpha-config=/etc/oauth2_proxy/alpha_config/alpha_config.yaml"
+  imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
+  env:
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: "http://localhost:4180/oauth2/callback"
+    - name: OAUTH2_PROXY_COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: "*"
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
+      value: write
+    - name: OAUTH2_PROXY_HTPASSWD_FILE
+      value: /etc/oauth2_proxy/basicauth/{{ .Values.authentication.basicAuth.filename }}
+    {{- end }}
+    {{- if not .Values.authentication.basicAuth.enabled }}
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: ".*"
+    {{- else }}
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: "^/health(/liveness)?$"
+    {{- end }}
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.oauth2Proxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: alpha-config
+      mountPath: /etc/oauth2_proxy/alpha_config
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - name: {{ .Release.Name }}-htpasswd
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+    {{- end }}
+    {{- if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+    - name: {{ .Release.Name }}-oauth2proxy-tls
+      mountPath: /etc/tls/private
+    {{- end }}
+{{- end}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_openshiftOauthProxy.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_openshiftOauthProxy.tpl
new file mode 100644
index 000000000..a4d703dc6
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_openshiftOauthProxy.tpl
@@ -0,0 +1,59 @@
+{{/*
+Create OpenShift OAuth Proxy container.
+*/}}
+{{- define "cryostat.openshiftOauthProxy" -}}
+- name: {{ printf "%s-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml .Values.openshiftOauthProxy.securityContext | nindent 4 }}
+  image: "{{ .Values.openshiftOauthProxy.image.repository }}:{{ .Values.openshiftOauthProxy.image.tag }}"
+  env:
+    - name: COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+  args:
+    - --skip-provider-button={{ not .Values.authentication.basicAuth.enabled }}
+    - --pass-access-token=false
+    - --pass-user-bearer-token=false
+    - --pass-basic-auth=false
+    - --upstream=http://localhost:8181/
+    - --upstream=http://localhost:3000/grafana/
+    - --cookie-secret=$(COOKIE_SECRET)
+    - --openshift-service-account={{ include "cryostat.serviceAccountName" . }}
+    - --proxy-websockets=true
+    - --http-address=0.0.0.0:4180
+    - --https-address=:8443
+    - --tls-cert=/etc/tls/private/tls.crt
+    - --tls-key=/etc/tls/private/tls.key
+    - --proxy-prefix=/oauth2
+    {{- if .Values.openshiftOauthProxy.accessReview.enabled }}
+    - --openshift-sar=[{{ tpl ( omit .Values.openshiftOauthProxy.accessReview "enabled" | toJson ) . }}]
+    - --openshift-delegate-urls={"/":{{ tpl ( omit .Values.openshiftOauthProxy.accessReview "enabled" | toJson ) . }}}
+    {{- end }}
+    - --bypass-auth-for=^/health(/liveness)?$
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - --htpasswd-file=/etc/openshift_oauth_proxy/basicauth/{{ .Values.authentication.basicAuth.filename }}
+    {{- end }}
+  imagePullPolicy: {{ .Values.openshiftOauthProxy.image.pullPolicy }}
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+    - containerPort: 8443
+      name: https
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.openshiftOauthProxy.resources | nindent 4 }}
+  volumeMounts:
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - name: {{ .Release.Name }}-htpasswd
+      mountPath: /etc/openshift_oauth_proxy/basicauth
+      readOnly: true
+    {{- end }}
+    - name: {{ .Release.Name }}-proxy-tls
+      mountPath: /etc/tls/private
+  terminationMessagePath: /dev/termination-log
+  terminationMessagePolicy: File
+{{- end}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_reports_authproxy.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_reports_authproxy.tpl
new file mode 100644
index 000000000..90292e705
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/_reports_authproxy.tpl
@@ -0,0 +1,148 @@
+{{- define "cryostat.reportsAuthProxy" -}}
+{{- if (.Values.authentication.openshift).enabled }}
+- name: {{ printf "%s-reports-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml .Values.openshiftOauthProxy.securityContext | nindent 4 }}
+  image: "{{ .Values.openshiftOauthProxy.image.repository }}:{{ .Values.openshiftOauthProxy.image.tag }}"
+  env:
+    - name: COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+  args:
+    - --pass-access-token=false
+    - --pass-user-bearer-token=false
+    - --pass-basic-auth=false
+    - --htpasswd-file=/etc/oauth2_proxy/basicauth/htpasswd
+    - --upstream=http://localhost:10001/
+    - --cookie-secret=$(COOKIE_SECRET)
+    - --request-logging=true
+    - --openshift-service-account={{ include "cryostat.serviceAccountName" . }}
+    - --proxy-websockets=true
+    - --http-address=0.0.0.0:4180
+    - --https-address=:8443
+    - --tls-cert=/etc/tls/private/tls.crt
+    - --tls-key=/etc/tls/private/tls.key
+    - --proxy-prefix=/oauth2
+    - --bypass-auth-for=^/health$
+  imagePullPolicy: {{ .Values.openshiftOauthProxy.image.pullPolicy }}
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+    - containerPort: 8443
+      name: https
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.openshiftOauthProxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: {{ .Release.Name }}-proxy-tls
+      mountPath: /etc/tls/private
+    - name: {{ .Release.Name }}-reports-secret
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+  terminationMessagePath: /dev/termination-log
+  terminationMessagePolicy: File
+{{- else if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+- name: {{ printf "%s-reports-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml (.Values.oauth2Proxy).securityContext | nindent 4 }}
+  image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
+  imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
+  env:
+    - name: OAUTH2_PROXY_CLIENT_ID
+      value: dummy
+    - name: OAUTH2_PROXY_CLIENT_SECRET
+      value: none
+    - name: OAUTH2_PROXY_HTTP_ADDRESS
+      value: 0.0.0.0:4180
+    - name: OAUTH2_PROXY_HTTPS_ADDRESS
+      value: :8443
+    - name: OAUTH2_PROXY_TLS_CERT_FILE
+      value: /etc/tls/private/cert
+    - name: OAUTH2_PROXY_TLS_KEY_FILE
+      value: /etc/tls/private/key
+    - name: OAUTH2_PROXY_UPSTREAMS
+      value: http://localhost:10001/
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: "http://localhost:4180/oauth2/callback"
+    - name: OAUTH2_PROXY_COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: "*"
+    - name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
+      value: write
+    - name: OAUTH2_PROXY_HTPASSWD_FILE
+      value: /etc/oauth2_proxy/basicauth/htpasswd
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: "^/health$"
+    - name: OAUTH2_PROXY_PROXY_WEBSOCKETS
+      value: "false"
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+    - containerPort: 8443
+      name: https
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.oauth2Proxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: {{ .Release.Name }}-reports-secret
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+    {{- if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+    - name: {{ .Release.Name }}-oauth2proxy-reports-tls
+      mountPath: /etc/tls/private
+    {{- end }}
+{{- else }}
+- name: {{ printf "%s-reports-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml (.Values.oauth2Proxy).securityContext | nindent 4 }}
+  image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
+  imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
+  env:
+    - name: OAUTH2_PROXY_CLIENT_ID
+      value: dummy
+    - name: OAUTH2_PROXY_CLIENT_SECRET
+      value: none
+    - name: OAUTH2_PROXY_HTTP_ADDRESS
+      value: 0.0.0.0:4180
+    - name: OAUTH2_PROXY_UPSTREAMS
+      value: http://localhost:10001/
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: "http://localhost:4180/oauth2/callback"
+    - name: OAUTH2_PROXY_COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: "*"
+    - name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
+      value: write
+    - name: OAUTH2_PROXY_HTPASSWD_FILE
+      value: /etc/oauth2_proxy/basicauth/htpasswd
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: "^/health$"
+    - name: OAUTH2_PROXY_PROXY_WEBSOCKETS
+      value: "false"
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.oauth2Proxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: {{ .Release.Name }}-reports-secret
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+{{- end }}
+{{- end}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/alpha_config.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/alpha_config.yaml
new file mode 100644
index 000000000..63094fe45
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/alpha_config.yaml
@@ -0,0 +1,38 @@
+{{/*
+   Alpha Configuration is not used with OpenShift OAuth Proxy
+*/}}
+{{- if not (.Values.authentication.openshift).enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-alpha-config
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+data:
+  alpha_config.yaml: |-
+    server:
+      BindAddress: http://0.0.0.0:4180
+      {{- if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+      SecureBindAddress: https://0.0.0.0:8443
+      TLS:
+        Key:
+          fromFile: /etc/tls/private/key
+        Cert:
+          fromFile: /etc/tls/private/cert
+      {{- end}}
+    upstreamConfig:
+      proxyRawPath: true
+      upstreams:
+        - id: cryostat
+          path: /
+          uri: http://localhost:8181
+        - id: grafana
+          path: /grafana/
+          uri: http://localhost:3000
+    providers:
+      - id: dummy
+        name: Unused - Sign In Below
+        clientId: CLIENT_ID
+        clientSecret: CLIENT_SECRET
+        provider: google
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/clusterrolebinding.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..4721c7c3b
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/clusterrolebinding.yaml
@@ -0,0 +1,16 @@
+{{- if and (.Values.rbac.create) (.Values.authentication.openshift.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cryostat.fullname" . }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.authentication.openshift.clusterRole.name }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cryostat.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cookie_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cookie_secret.yaml
new file mode 100644
index 000000000..76b44fc0e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cookie_secret.yaml
@@ -0,0 +1,11 @@
+{{- if empty .Values.authentication.cookieSecretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-cookie-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+data:
+  COOKIE_SECRET: {{ include "cryostat.cookieSecret" . }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_deployment.yaml
new file mode 100644
index 000000000..2e222b9f1
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_deployment.yaml
@@ -0,0 +1,250 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: cryostat
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: cryostat
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.core.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: cryostat
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "cryostat.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        {{- if (.Values.authentication.openshift).enabled }}
+        {{- include "cryostat.openshiftOauthProxy" . | nindent 8 }}
+        {{- else }}
+        {{- include "cryostat.oauth2Proxy" . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.core.securityContext | nindent 12 }}
+          image: "{{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}"
+          imagePullPolicy: {{ .Values.core.image.pullPolicy }}
+          env:
+          - name: QUARKUS_HTTP_HOST
+            value: localhost
+          - name: QUARKUS_LOG_LEVEL
+            value: {{ .Values.core.debug.log.level }}
+          - name: QUARKUS_HTTP_PORT
+            value: "8181"
+          - name: QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING
+            value: 'true'
+          - name: QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED
+            value: 'true'
+          - name: QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST
+            value: 'true'
+          - name: QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX
+            value: 'true'
+          - name: QUARKUS_HIBERNATE_ORM_DATABASE_GENERATION
+            value: none
+          - name: QUARKUS_HIBERNATE_ORM_SQL_LOAD_SCRIPT
+            value: no-file
+          {{- if gt (int (.Values.reports).replicas) 0 }}
+          - name: REPORTS_PASS_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-reports-secret" .Release.Name) .Values.reports.reportsSecretName }}
+                key: REPORTS_PASS
+                optional: false
+          # TODO TLS trust
+          - name: QUARKUS_TLS_TRUST_ALL
+            value: "true"
+          - name: QUARKUS_REST_CLIENT_EXTENSIONS_API_VERIFY_HOST
+            value: "false"
+          - name: QUARKUS_REST_CLIENT_REPORTS_URL
+            value: {{ printf "%s://cryostat:$(REPORTS_PASS_SECRET_KEY)@%s-reports.%s.svc:%d" (include "cryostat.core.service.scheme" .) $fullName $.Release.Namespace (int .Values.reports.service.httpPort) }}
+          {{- end }}
+          - name: QUARKUS_DATASOURCE_USERNAME
+            value: cryostat
+          - name: QUARKUS_DATASOURCE_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-db" .Release.Name) .Values.core.databaseSecretName }}
+                key: CONNECTION_KEY
+                optional: false
+          - name: QUARKUS_DATASOURCE_JDBC_URL
+            value: jdbc:postgresql://{{ $fullName }}-db:5432/cryostat
+          - name: STORAGE_BUCKETS_ARCHIVES_NAME
+            value: archivedrecordings
+          - name: QUARKUS_S3_ENDPOINT_OVERRIDE
+            value: http://{{ $fullName }}-storage:8333
+          - name: QUARKUS_S3_PATH_STYLE_ACCESS
+            value: "true"
+          - name: QUARKUS_S3_AWS_REGION
+            value: us-east-1
+          - name: QUARKUS_S3_AWS_CREDENTIALS_TYPE
+            value: static
+          - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID
+            value: cryostat
+          - name: AWS_ACCESS_KEY_ID
+            value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID)
+          - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-storage-secret" .Release.Name) .Values.storage.storageSecretName }}
+                key: STORAGE_ACCESS_KEY
+                optional: false
+          - name: AWS_SECRET_ACCESS_KEY
+            value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY)
+          - name: GRAFANA_DATASOURCE_URL
+            value: http://localhost:8800
+          - name: GRAFANA_DASHBOARD_URL
+            value: http://localhost:3000
+          - name: GRAFANA_DASHBOARD_EXT_URL
+            value: /grafana/
+          {{- if .Values.core.discovery.kubernetes.enabled }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_ENABLED
+            value: "true"
+          {{- with .Values.core.discovery.kubernetes }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_NAMESPACES
+            value: {{ include "cryostat.commaSepList" (list .namespaces $.Release.Namespace .installNamespaceDisabled) }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NAMES
+            value: {{ include "cryostat.commaSepList" (list .portNames "jfr-jmx" .builtInPortNamesDisabled) }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NUMBERS
+            value: {{ include "cryostat.commaSepList" (list .portNumbers 9091 .builtInPortNumbersDisabled) }}
+          {{- end }}
+          {{- end }}
+          ports:
+            - containerPort: 8181
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - curl
+                - --fail
+                - http://localhost:8181/health/liveness
+          startupProbe:
+            exec:
+              command:
+                - curl
+                - --fail
+                - http://localhost:8181/health/liveness
+            failureThreshold: 18
+          resources:
+            {{- toYaml .Values.core.resources | nindent 12 }}
+          volumeMounts:
+          {{- range .Values.core.config.eventTemplates.configMapNames }}
+            - name: {{ . }}
+              mountPath: /opt/cryostat.d/templates.d/{{ . }}
+              readOnly: true
+          {{- end }}
+          {{- range .Values.core.config.tlsTruststore.secretNames }}
+            - name: {{ . }}
+              mountPath: /truststore/{{ . }}
+              readOnly: true
+          {{- end }}
+        - name: {{ printf "%s-%s" .Chart.Name "grafana" }}
+          securityContext:
+            {{- toYaml .Values.grafana.securityContext | nindent 12 }}
+          image: "{{ .Values.grafana.image.repository }}:{{ .Values.grafana.image.tag }}"
+          imagePullPolicy: {{ .Values.grafana.image.pullPolicy }}
+          env:
+          - name: GF_AUTH_ANONYMOUS_ENABLED
+            value: "true"
+          - name: GF_SERVER_DOMAIN
+            value: localhost
+          - name: GF_SERVER_ROOT_URL
+            value: http://localhost:4180/grafana/
+          - name: GF_SERVER_SERVE_FROM_SUB_PATH
+            value: "true"
+          - name: JFR_DATASOURCE_URL
+            value: http://localhost:8800
+          ports:
+          - containerPort: 3000
+            protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3000
+          resources:
+            {{- toYaml .Values.grafana.resources | nindent 12 }}
+        - name: {{ printf "%s-%s" .Chart.Name "jfr-datasource" }}
+          securityContext:
+            {{- toYaml .Values.datasource.securityContext | nindent 12 }}
+          image: "{{ .Values.datasource.image.repository }}:{{ .Values.datasource.image.tag }}"
+          imagePullPolicy: {{ .Values.datasource.image.pullPolicy }}
+          env:
+          - name: LISTEN_HOST
+            value: localhost
+          - name: QUARKUS_HTTP_PORT
+            value: "8800"
+          ports:
+          - containerPort: 8800
+            protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+              - curl
+              - --fail
+              - http://localhost:8800
+          resources:
+            {{- toYaml .Values.datasource.resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.core.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.core.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.core.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if not (.Values.authentication.openshift).enabled }}
+      - name: alpha-config
+        configMap:
+          name: {{ .Release.Name }}-alpha-config
+      {{- end }}
+      {{- if .Values.authentication.basicAuth.enabled }}
+      - name: {{ .Release.Name }}-htpasswd
+        secret:
+          defaultMode: 0440
+          secretName: {{ .Values.authentication.basicAuth.secretName }}
+      {{- end }}
+      {{- if (.Values.authentication.openshift).enabled }}
+      - name: {{ .Release.Name }}-proxy-tls
+        secret:
+          secretName: {{ .Release.Name }}-proxy-tls
+      {{- else if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+      - name: {{ .Release.Name }}-oauth2proxy-tls
+        secret:
+          secretName: {{ .Release.Name }}-oauth2proxy-tls
+      {{- end }}
+      {{- range .Values.core.config.eventTemplates.configMapNames}}
+      - name: {{ . }}
+        configMap:
+          name: {{ . }}
+      {{- end }}
+      {{- range .Values.core.config.tlsTruststore.secretNames }}
+      - name: {{ . }}
+        secret:
+          secretName: {{ . }}
+      {{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_service.yaml
new file mode 100644
index 000000000..36261e437
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_service.yaml
@@ -0,0 +1,31 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: cryostat
+  {{- if (.Values.authentication.openshift).enabled }}
+  annotations:
+    service.alpha.openshift.io/serving-cert-secret-name: {{ .Release.Name }}-proxy-tls
+  {{- end }}
+spec:
+  type: {{ .Values.core.service.type }}
+  ports:
+    - port: {{ .Values.core.service.httpPort }}
+      targetPort: 4180
+      protocol: TCP
+      name: http
+      appProtocol: http
+    {{- if ( include "cryostat.core.service.tls" . | eq "true" ) }}
+    - port: 443
+      targetPort: 8443
+      protocol: TCP
+      name: https
+      appProtocol: https
+    {{- end }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_tls_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_tls_secret.yaml
new file mode 100644
index 000000000..0d057454a
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/cryostat_tls_secret.yaml
@@ -0,0 +1,15 @@
+{{- if ( include "cryostat.core.service.tls" . | eq "true" ) }}
+{{- $fullName := include "cryostat.fullname" . }}
+{{- $cert := genSelfSignedCert $fullName nil nil 365 }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-oauth2proxy-tls
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+immutable: true
+data:
+  cert: {{ $cert.Cert | b64enc }}
+  key: {{ $cert.Key | b64enc }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_deployment.yaml
new file mode 100644
index 000000000..837195977
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_deployment.yaml
@@ -0,0 +1,98 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}-db
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: db
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: db
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.db.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: db
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ printf "%s-%s" .Chart.Name "db" }}
+          securityContext:
+            {{- toYaml (.Values.db).securityContext | nindent 12 }}
+          image: "{{ (.Values.db).image.repository }}:{{ (.Values.db).image.tag }}"
+          imagePullPolicy: {{ (.Values.db).image.pullPolicy }}
+          env:
+          - name: POSTGRESQL_USER
+            value: cryostat
+          - name: POSTGRESQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-db" .Release.Name) .Values.core.databaseSecretName }}
+                key: CONNECTION_KEY
+                optional: false
+          - name: POSTGRESQL_DATABASE
+            value: cryostat
+          - name: PG_ENCRYPT_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-db" .Release.Name) .Values.core.databaseSecretName }}
+                key: ENCRYPTION_KEY
+                optional: false
+          ports:
+            - containerPort: 5432
+              protocol: TCP
+          volumeMounts:
+          - mountPath: /var/lib/pgsql/data
+            name: {{ .Chart.Name }}-db
+            subPath: postgres
+          readinessProbe:
+            exec:
+              command:
+              - pg_isready
+              - -U
+              - cryostat
+              - -d
+              - cryostat
+          resources:
+            {{- toYaml (.Values.db).resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.db.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.db.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.db.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if ((.Values.db.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-db
+        persistentVolumeClaim:
+          claimName: {{ .Release.Name }}-db
+      {{- end }}
+      {{- if not ((.Values.db.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-db
+        emptyDir: {}
+      {{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_pvc.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_pvc.yaml
new file mode 100644
index 000000000..78c2abc34
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_pvc.yaml
@@ -0,0 +1,27 @@
+{{- if ((.Values.db.pvc).enabled) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cryostat.fullname" . }}-db
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .Values.db.pvc.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.db.pvc.accessModes }}
+  accessModes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.db.pvc.storage }}
+  {{- if kindIs "string" .Values.db.pvc.storageClassName }}
+  storageClassName: {{ .Values.db.pvc.storageClassName | quote }}
+  {{- end }}
+  {{- with .Values.db.pvc.selector }}
+  selector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_secret.yaml
new file mode 100644
index 000000000..798638375
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_secret.yaml
@@ -0,0 +1,13 @@
+{{- if empty .Values.core.databaseSecretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-db
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+immutable: true
+data:
+  ENCRYPTION_KEY: {{ include "cryostat.databaseEncryptionKey" . }}
+  CONNECTION_KEY: {{ include "cryostat.databaseConnectionKey" . }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_service.yaml
new file mode 100644
index 000000000..402e189fb
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/db_service.yaml
@@ -0,0 +1,16 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}-db
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: db
+spec:
+  type: {{ .Values.db.service.type }}
+  ports:
+    - port: {{ .Values.db.service.port }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: db
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/ingress.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/ingress.yaml
new file mode 100644
index 000000000..4a051f66c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/ingress.yaml
@@ -0,0 +1,70 @@
+{{- define "cryostat.createIngress" }}
+{{- $svcName := index . 0 }}
+{{- $svcPort := index . 1 }}
+{{- $ := index . 2 }}
+{{- with index . 3 }}
+{{- if and .ingress.className (not (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .ingress.annotations "kubernetes.io/ingress.class" .ingress.className}}
+  {{- end }}
+{{- end }}
+---
+{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" $.Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $svcName }}
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .ingress.className (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .ingress.className }}
+  {{- end }}
+  {{- if .ingress.tls }}
+  tls:
+    {{- range .ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $svcName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
+{{- end }}
+
+{{- $fullName := include "cryostat.fullname" . -}}
+{{- if .Values.core.ingress.enabled }}
+{{- include "cryostat.createIngress" (list $fullName .Values.core.service.httpPort $ .Values.core)}}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/networkpolicy_ingress.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/networkpolicy_ingress.yaml
new file mode 100644
index 000000000..b827a8e21
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/networkpolicy_ingress.yaml
@@ -0,0 +1,87 @@
+{{- if ((.Values.networkPolicy.ingress).enabled) }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-cryostat-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: cryostat
+  ingress:
+    - from:
+      - namespaceSelector: {}
+      ports:
+        - protocol: TCP
+          port: 4180
+        - protocol: TCP
+          port: 8443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-reports-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: reports
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "cryostat.selectorLabels" $ | nindent 12 }}
+            app.kubernetes.io/component: cryostat
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      ports:
+        - protocol: TCP
+          port: 4180
+        - protocol: TCP
+          port: 8443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-db-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: db
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "cryostat.selectorLabels" $ | nindent 12 }}
+            app.kubernetes.io/component: cryostat
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-storage-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: storage
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "cryostat.selectorLabels" $ | nindent 12 }}
+            app.kubernetes.io/component: cryostat
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      ports:
+        - protocol: TCP
+          port: 8333
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_deployment.yaml
new file mode 100644
index 000000000..b3503f00b
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_deployment.yaml
@@ -0,0 +1,93 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+{{- if gt (int (.Values.reports).replicas) 0 -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}-reports
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: reports
+spec:
+  replicas: {{ (.Values.reports).replicas }}
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: reports
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.reports.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: reports
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        {{- include "cryostat.reportsAuthProxy" . | nindent 8 }}
+        - name: {{ printf "%s-%s" .Chart.Name "reports" }}
+          securityContext:
+            {{- toYaml (.Values.reports).securityContext | nindent 12 }}
+          image: "{{ (.Values.reports).image.repository }}:{{ (.Values.reports).image.tag }}"
+          imagePullPolicy: {{ (.Values.reports).image.pullPolicy }}
+          env:
+            - name: QUARKUS_HTTP_PORT
+              value: "{{ .Values.reports.service.httpPort }}"
+            - name: QUARKUS_LOG_LEVEL
+              value: {{ .Values.reports.debug.log.level }}
+          ports:
+            - containerPort: {{ .Values.reports.service.httpPort }}
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: "/health"
+              port: {{ .Values.reports.service.httpPort }}
+            periodSeconds: 10
+            failureThreshold: 9
+          livenessProbe:
+            httpGet:
+              path: "/health"
+              port: {{ .Values.reports.service.httpPort }}
+            periodSeconds: 10
+            failureThreshold: 2
+          resources:
+            {{- toYaml (.Values.reports).resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.reports.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.reports.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.reports.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      - name: {{ .Release.Name }}-reports-secret
+        secret:
+          defaultMode: 0440
+          secretName: {{ .Release.Name }}-reports-secret
+      {{- if (.Values.authentication.openshift).enabled }}
+      - name: {{ .Release.Name }}-proxy-tls
+        secret:
+          secretName: {{ .Release.Name }}-proxy-tls
+      {{- else if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+      - name: {{ .Release.Name }}-oauth2proxy-reports-tls
+        secret:
+          secretName: {{ .Release.Name }}-oauth2proxy-reports-tls
+      {{- end }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_secret.yaml
new file mode 100644
index 000000000..988de13c8
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_secret.yaml
@@ -0,0 +1,13 @@
+{{- if empty .Values.reports.reportsSecretName -}}
+{{- $secretKey := include "cryostat.reportsPassSecretKey" . -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-reports-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+data:
+  REPORTS_PASS: {{ $secretKey | b64enc }}
+  htpasswd: {{ htpasswd "cryostat" $secretKey | b64enc }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_service.yaml
new file mode 100644
index 000000000..a54836a63
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_service.yaml
@@ -0,0 +1,18 @@
+{{- if gt (int (.Values.reports).replicas) 0 -}}
+{{- $fullName := include "cryostat.fullname" . -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}-reports
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: reports
+spec:
+  type: {{ .Values.reports.service.type }}
+  ports:
+    - port: {{ .Values.reports.service.httpPort }}
+      targetPort: {{ include "cryostat.core.service.scheme" . }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: reports
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_tls_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_tls_secret.yaml
new file mode 100644
index 000000000..79dbf2582
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/reports_tls_secret.yaml
@@ -0,0 +1,15 @@
+{{- if ( include "cryostat.core.service.tls" . | eq "true" ) }}
+{{- $fullName := include "cryostat.fullname" . }}
+{{- $cert := genSelfSignedCert (printf "%s-reports" $fullName) nil nil 365 }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-oauth2proxy-reports-tls
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+immutable: true
+data:
+  cert: {{ $cert.Cert | b64enc }}
+  key: {{ $cert.Key | b64enc }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/role.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/role.yaml
new file mode 100644
index 000000000..98f96c609
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/role.yaml
@@ -0,0 +1,61 @@
+{{- define "cryostat.createRole" -}}
+{{- $ns := index .  0 -}}
+{{- with index . 1 -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "cryostat.fullname" . }}
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - replicationcontrollers
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - replicasets
+  - deployments
+  - daemonsets
+  - statefulsets
+  verbs:
+  - get
+- apiGroups:
+  - apps.openshift.io
+  resources:
+  - deploymentconfigs
+  verbs:
+  - get
+- apiGroups:
+  - route.openshift.io
+  resources:
+  - routes
+  verbs:
+  - get
+  - list
+{{- end -}}
+{{- end -}}
+
+{{- if and .Values.rbac.create .Values.core.discovery.kubernetes.enabled -}}
+{{- $watchNs := compact (default list .Values.core.discovery.kubernetes.namespaces) | uniq -}}
+{{- if and (not $watchNs) (not .Values.core.discovery.kubernetes.installNamespaceDisabled) -}}
+{{- $watchNs = list .Release.Namespace -}}
+{{- end -}}
+{{- range $ns := $watchNs }}
+{{ include "cryostat.createRole" (list $ns $) }}
+{{- end -}}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/rolebinding.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/rolebinding.yaml
new file mode 100644
index 000000000..b24049667
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/rolebinding.yaml
@@ -0,0 +1,31 @@
+{{- define "cryostat.createRolebinding" -}}
+{{- $ns := index .  0 -}}
+{{- with index . 1 -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "cryostat.fullname" . }}
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "cryostat.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cryostat.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}
+
+{{- if and .Values.rbac.create .Values.core.discovery.kubernetes.enabled -}}
+{{- $watchNs := compact (default list .Values.core.discovery.kubernetes.namespaces) | uniq -}}
+{{- if and (not $watchNs) (not .Values.core.discovery.kubernetes.installNamespaceDisabled) -}}
+{{- $watchNs = list .Release.Namespace -}}
+{{- end -}}
+{{- range $ns := $watchNs }}
+{{ include "cryostat.createRolebinding" (list $ns $) }}
+{{- end -}}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/route.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/route.yaml
new file mode 100644
index 000000000..608269c11
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/route.yaml
@@ -0,0 +1,50 @@
+{{- define "cryostat.createRoute" }}
+{{- $svcName := index . 0 }}
+{{- $targetPort := index . 1 }}
+{{- $ := index . 2 }}
+{{- with index . 3 }}
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: {{ $svcName }}
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .route.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  to:
+    kind: Service
+    name: {{ $svcName }}
+  port:
+    targetPort: {{ $targetPort }}
+{{- if .route.tls.enabled }}
+  tls:
+    termination: {{ .route.tls.termination }}
+    insecureEdgeTerminationPolicy: {{ .route.tls.insecureEdgeTerminationPolicy }}
+  {{- if .route.tls.key }}
+    key: |-
+      {{- .route.tls.key | nindent 6 }}
+  {{- end }}
+  {{- if .route.tls.destinationCACertificate }}
+    destinationCACertificate: |-
+      {{- .route.tls.destinationCACertificate | nindent 6 }}
+  {{- end }}
+  {{- if .route.tls.caCertificate }}
+    caCertificate: |-
+      {{- .route.tls.caCertificate | nindent 6 }}
+  {{- end }}
+  {{- if .route.tls.certificate }}
+    certificate: |-
+      {{- .route.tls.certificate | nindent 6 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- $fullName := include "cryostat.fullname" . -}}
+{{- if .Values.core.route.enabled }}
+{{- include "cryostat.createRoute" (list $fullName 4180 $ .Values.core)}}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/serviceaccount.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/serviceaccount.yaml
new file mode 100644
index 000000000..e6da50e61
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/serviceaccount.yaml
@@ -0,0 +1,17 @@
+{{- if (.Values.authentication.openshift).enabled -}}
+{{- $fullName := include "cryostat.fullname" . -}}
+{{- $redirectAnnotations := dict "serviceaccounts.openshift.io/oauth-redirectreference.primary" (printf "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"%s\"}}" $fullName) -}}
+{{- $_ := merge .Values.serviceAccount.annotations $redirectAnnotations -}}
+{{- end -}}
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "cryostat.serviceAccountName" . }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_deployment.yaml
new file mode 100644
index 000000000..a7aa6084f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_deployment.yaml
@@ -0,0 +1,112 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}-storage
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: storage
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.storage.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: storage
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ printf "%s-%s" .Chart.Name "storage" }}
+          securityContext:
+            {{- toYaml (.Values.storage).securityContext | nindent 12 }}
+          image: "{{ (.Values.storage).image.repository }}:{{ (.Values.storage).image.tag }}"
+          imagePullPolicy: {{ (.Values.storage).image.pullPolicy }}
+          env:
+          - name: CRYOSTAT_BUCKETS
+            value: archivedrecordings,archivedreports,eventtemplates,probes
+          - name: CRYOSTAT_ACCESS_KEY
+            value: cryostat
+          - name: CRYOSTAT_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-storage-secret" .Release.Name) .Values.storage.storageSecretName }}
+                key: STORAGE_ACCESS_KEY
+                optional: false
+          - name: DATA_DIR
+            value: /data
+          - name: IP_BIND
+            value: 0.0.0.0
+          - name: REST_ENCRYPTION_ENABLE
+            value: "{{ .Values.storage.encryption.enabled | ternary 1 0 }}"
+          ports:
+            - containerPort: 8333
+              protocol: TCP
+          volumeMounts:
+          - mountPath: /data
+            name: {{ .Chart.Name }}-storage
+            subPath: seaweed
+          startupProbe:
+            httpGet:
+              path: "/status"
+              port: 8333
+            periodSeconds: 10
+            failureThreshold: 9
+          livenessProbe:
+            httpGet:
+              path: "/status"
+              port: 8333
+            periodSeconds: 10
+            failureThreshold: 2
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - echo s3.bucket.list | weed shell | [[ "$(</dev/stdin)" == *"archivedrecordings"* ]]
+            failureThreshold: 2
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            {{- toYaml (.Values.storage).resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.storage.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.storage.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.storage.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if ((.Values.storage.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-storage
+        persistentVolumeClaim:
+          claimName: {{ .Release.Name }}-storage
+      {{- end }}
+      {{- if not ((.Values.storage.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-storage
+        emptyDir: {}
+      {{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_pvc.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_pvc.yaml
new file mode 100644
index 000000000..e44cc5641
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_pvc.yaml
@@ -0,0 +1,27 @@
+{{- if ((.Values.storage.pvc).enabled) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cryostat.fullname" . }}-storage
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .Values.storage.pvc.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.storage.pvc.accessModes }}
+  accessModes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.storage.pvc.storage }}
+  {{- if kindIs "string" .Values.storage.pvc.storageClassName }}
+  storageClassName: {{ .Values.storage.pvc.storageClassName | quote }}
+  {{- end }}
+  {{- with .Values.storage.pvc.selector }}
+  selector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_secret.yaml
new file mode 100644
index 000000000..b402eaaa0
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_secret.yaml
@@ -0,0 +1,11 @@
+{{- if empty .Values.storage.storageSecretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-storage-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+data:
+  STORAGE_ACCESS_KEY: {{ include "cryostat.objectStorageSecretKey" . }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_service.yaml
new file mode 100644
index 000000000..0d074d08e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/storage_service.yaml
@@ -0,0 +1,16 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}-storage
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  type: {{ .Values.storage.service.type }}
+  ports:
+    - port: {{ .Values.storage.service.port }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: storage
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/tests/test-core-connection.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/tests/test-core-connection.yaml
new file mode 100644
index 000000000..f5a087c89
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/tests/test-core-connection.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "cryostat.fullname" . }}-test-core-connection"
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: test-core-connection
+    charts.cryostat.io/role: helm-test
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: curl
+      image: registry.access.redhat.com/ubi8/ubi:latest
+      command:
+        - '/bin/bash'
+        - '-exc'
+        - >
+          dnf install --disableplugin=subscription-manager -yq jq;
+          curl -sSf --retry 10 --retry-connrefused http://{{ include "cryostat.fullname" . }}:{{ .Values.core.service.httpPort }}/health | tee /tmp/out.json;
+          cat /tmp/out.json;
+          {{- if hasSuffix "-dev" .Chart.AppVersion }}
+          jq -e '{{ printf "(.cryostatVersion | test(\"^v%s-snapshot$\"))" (.Chart.AppVersion | trimSuffix "-dev" | squote) }}' /tmp/out.json;
+          {{- else }}
+          jq -e '{{ printf "(.cryostatVersion | test(\"^v%s\"))" (.Chart.AppVersion | replace "-" "." | squote) }}' /tmp/out.json;
+          {{- end }}
+          jq -e '.datasourceAvailable' /tmp/out.json
+  restartPolicy: Never
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/tests/test-grafana-connection.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/tests/test-grafana-connection.yaml
new file mode 100644
index 000000000..84b3dfcea
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/templates/tests/test-grafana-connection.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "cryostat.fullname" . }}-test-grafana-connection"
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: test-grafana-connection
+    charts.cryostat.io/role: helm-test
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: curl
+      image: registry.access.redhat.com/ubi8/ubi:latest
+      command:
+        - '/bin/bash'
+        - '-exc'
+        - curl -sSf --retry 10 --retry-connrefused http://{{ include "cryostat.fullname" . }}:{{ .Values.core.service.httpPort }}/grafana/api/health
+  restartPolicy: Never
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/alpha_config_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/alpha_config_test.yaml
new file mode 100644
index 000000000..c0312ad38
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/alpha_config_test.yaml
@@ -0,0 +1,45 @@
+suite: test alpha_config.yaml
+templates:
+  - templates/alpha_config.yaml
+
+tests:
+  - it: should create configmap with correct alpha configurations
+    asserts:
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "server:\\s*BindAddress: http://0.0.0.0:4180"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "upstreamConfig:\\s*proxyRawPath: true\\s*upstreams:\\s*- id: cryostat\\s*path: /\\s*uri: http://localhost:8181"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "- id: grafana\\s*path: /grafana/\\s*uri: http://localhost:3000"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "providers:\\s*- id: dummy\\s*name: Unused - Sign In Below\\s*clientId: CLIENT_ID\\s*clientSecret: CLIENT_SECRET\\s*provider: google"
+
+  - it: should create configmap with correct alpha configurations when self-signed TLS is enabled
+    set:
+      oauth2Proxy.tls.selfSigned.enabled: true
+    asserts:
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "server:\\s*BindAddress: http://0.0.0.0:4180\\s*SecureBindAddress: https://0.0.0.0:8443"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "upstreamConfig:\\s*proxyRawPath: true\\s*upstreams:\\s*- id: cryostat\\s*path: /\\s*uri: http://localhost:8181"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "- id: grafana\\s*path: /grafana/\\s*uri: http://localhost:3000"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "providers:\\s*- id: dummy\\s*name: Unused - Sign In Below\\s*clientId: CLIENT_ID\\s*clientSecret: CLIENT_SECRET\\s*provider: google"
+
+  - it: should not create alpha_config when openshift authentication is enabled
+    set:
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/clusterrolebinding_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/clusterrolebinding_test.yaml
new file mode 100644
index 000000000..0d867408c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/clusterrolebinding_test.yaml
@@ -0,0 +1,65 @@
+suite: test clusterrolebinding.yaml
+templates:
+  - clusterrolebinding.yaml
+
+tests:
+  - it: should create a ClusterRoleBinding when RBAC and OpenShift authentication are enabled
+    set:
+      rbac.create: true
+      authentication.openshift.enabled: true
+      authentication.openshift.clusterRole.name: system:auth-delegator
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: roleRef.apiGroup
+          value: rbac.authorization.k8s.io
+      - equal:
+          path: roleRef.kind
+          value: ClusterRole
+      - equal:
+          path: roleRef.name
+          value: system:auth-delegator
+      - equal:
+          path: subjects[0].kind
+          value: ServiceAccount
+      - equal:
+          path: subjects[0].name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: subjects[0].namespace
+          value: NAMESPACE
+
+  - it: should create a ClusterRoleBinding with a custom OpenShift cluster role
+    set:
+      rbac.create: true
+      authentication.openshift.enabled: true
+      authentication.openshift.clusterRole.name: custom-clusterrole
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: roleRef.name
+          value: custom-clusterrole
+
+
+  - it: should not create a ClusterRoleBinding when RBAC is disabled
+    set:
+      rbac.create: false
+      authentication.openshift.enabled: true
+      authentication.openshift.clusterRole.name: system:auth-delegator
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create a ClusterRoleBinding when OpenShift authentication is disabled
+    set:
+      rbac.create: true
+      authentication.openshift.enabled: false
+      authentication.openshift.clusterRole.name: system:auth-delegator
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cookie_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cookie_secret_test.yaml
new file mode 100644
index 000000000..208f87b71
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cookie_secret_test.yaml
@@ -0,0 +1,36 @@
+suite: test cookie_secret.yaml
+templates:
+  - cookie_secret.yaml
+
+tests:
+  - it: should create a Cookie Secret with correct settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cookie-secret
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.COOKIE_SECRET
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.2-redhat
+            helm.sh/chart: cryostat-2.0.2
+
+  - it: should not create a cookie secret if authentication.cookieSecretName is set
+    set:
+      authentication.cookieSecretName: "custom-cookie-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_deployment_test.yaml
new file mode 100644
index 000000000..5d9422daa
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_deployment_test.yaml
@@ -0,0 +1,737 @@
+suite: test cryostat_deployment.yaml
+templates:
+  - cryostat_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4
+      - equal:
+          path: spec.replicas
+          value: 1
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.2-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate all container settings including environment variables and security contexts
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].image
+          value: "registry.redhat.io/cryostat/cryostat-rhel9:4.0.2"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9:4.0.2"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PORT')].value
+          value: "8181"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_LOG_LEVEL')].value
+          value: "INFO"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_HOST')].value
+          value: "localhost"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HIBERNATE_ORM_DATABASE_GENERATION')].value
+          value: "none"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HIBERNATE_ORM_SQL_LOAD_SCRIPT')].value
+          value: "no-file"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_DATASOURCE_USERNAME')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_DATASOURCE_PASSWORD')].valueFrom.secretKeyRef
+          value:
+            key: "CONNECTION_KEY"
+            name: "RELEASE-NAME-db"
+            optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_DATASOURCE_JDBC_URL')].value
+          value: "jdbc:postgresql://RELEASE-NAME-cryostat-db:5432/cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='STORAGE_BUCKETS_ARCHIVES_NAME')].value
+          value: "archivedrecordings"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_ENDPOINT_OVERRIDE')].value
+          value: "http://RELEASE-NAME-cryostat-storage:8333"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_PATH_STYLE_ACCESS')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_REGION')].value
+          value: "us-east-1"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_TYPE')].value
+          value: "static"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='AWS_ACCESS_KEY_ID')].value
+          value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID)
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY')].valueFrom.secretKeyRef
+          value:
+              key: "STORAGE_ACCESS_KEY"
+              name: "RELEASE-NAME-storage-secret"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='AWS_SECRET_ACCESS_KEY')].value
+          value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY)
+      - notExists:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_REST_CLIENT_REPORTS_URL')].value
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='GRAFANA_DATASOURCE_URL')].value
+          value: "http://localhost:8800"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='GRAFANA_DASHBOARD_URL')].value
+          value: "http://localhost:3000"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='GRAFANA_DASHBOARD_EXT_URL')].value
+          value: "/grafana/"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_ENABLED')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_NAMESPACES')].value
+          value: "NAMESPACE"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NAMES')].value
+          value: "jfr-jmx"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NUMBERS')].value
+          value: "9091"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].ports[0].containerPort
+          value: 8181
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].livenessProbe.exec.command
+          value:
+            - curl
+            - --fail
+            - http://localhost:8181/health/liveness
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].startupProbe.exec.command
+          value:
+            - curl
+            - --fail
+            - http://localhost:8181/health/liveness
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].startupProbe.failureThreshold
+          value: 18
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].resources
+          value:
+            requests:
+              cpu: 500m
+              memory: 384Mi
+      - notExists:
+          path: spec.template.spec.contains[?(@.name=='cryostat')].volumeMounts
+
+  - it: should set log level
+    set:
+      core:
+        debug:
+          log:
+            level: TRACE
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_LOG_LEVEL')].value
+          value: TRACE
+
+  - it: should set environment variable if sidecar report generator is enabled
+    set:
+      reports:
+        replicas: 1
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_REST_CLIENT_REPORTS_URL')].value
+          value: http://cryostat:$(REPORTS_PASS_SECRET_KEY)@RELEASE-NAME-cryostat-reports.NAMESPACE.svc:10001
+
+  - it: should set environment variable if sidecar report generator is enabled in OpenShift with HTTPS
+    set:
+      reports:
+        replicas: 1
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_REST_CLIENT_REPORTS_URL')].value
+          value: https://cryostat:$(REPORTS_PASS_SECRET_KEY)@RELEASE-NAME-cryostat-reports.NAMESPACE.svc:10001
+
+  - it: should set oauth2proxy resource overrides
+    set:
+      oauth2Proxy:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set openshiftOauthProxy resource overrides
+    set:
+      authentication:
+        openshift:
+          enabled: true
+      openshiftOauthProxy:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set cryostat resource overrides
+    set:
+      core:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set grafana resource overrides
+    set:
+      grafana:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set jfr-datasource resource overrides
+    set:
+      datasource:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should validate cryostat-grafana settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].image
+          value: "registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_AUTH_ANONYMOUS_ENABLED')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_SERVER_DOMAIN')].value
+          value: "localhost"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_SERVER_ROOT_URL')].value
+          value: "http://localhost:4180/grafana/"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_SERVER_SERVE_FROM_SUB_PATH')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='JFR_DATASOURCE_URL')].value
+          value: "http://localhost:8800"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].ports[0].containerPort
+          value: 3000
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].livenessProbe.httpGet.path
+          value: "/api/health"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].livenessProbe.httpGet.port
+          value: 3000
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].resources
+          value:
+            requests:
+              cpu: 25m
+              memory: 80Mi
+
+  - it: should validate cryostat-jfr-datasource settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].image
+          value: "registry.redhat.io/cryostat/jfr-datasource-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].env[?(@.name=='LISTEN_HOST')].value
+          value: "localhost"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].env[?(@.name=='QUARKUS_HTTP_PORT')].value
+          value: "8800"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].ports[0].containerPort
+          value: 8800
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].livenessProbe.exec.command
+          value:
+              - curl
+              - --fail
+              - http://localhost:8800
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].resources
+          value:
+            requests:
+              cpu: 200m
+              memory: 200Mi
+
+  - it: should validate volumes and volume mounts
+    asserts:
+      - lengthEqual:
+          count: 1
+          path: spec.template.spec.volumes
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='alpha-config')]
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].volumeMounts[?(@.mountPath=='/etc/oauth2_proxy/alpha_config')]
+
+  - it: should validate volumes and volume mounts with oauth2-proxy self-signed TLS enabled
+    set:
+      oauth2Proxy.tls.selfSigned.enabled: true
+    asserts:
+      - lengthEqual:
+          count: 2
+          path: spec.template.spec.volumes
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='alpha-config')]
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].volumeMounts[?(@.mountPath=='/etc/oauth2_proxy/alpha_config')]
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='RELEASE-NAME-oauth2proxy-tls')]
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].volumeMounts[?(@.mountPath=='/etc/tls/private')]
+
+  - it: should set image pull secrets if specified
+    set:
+      imagePullSecrets:
+        - name: myregistrykey
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: "myregistrykey"
+
+  - it: should configure the OpenShift OAuth Proxy when authentication.openshift is enabled
+    set:
+      authentication.openshift.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9:4.0.2"
+
+  - it: should configure the OAuth2 Proxy when OpenShift OAuth is disabled and OAuth2 is enabled
+    set:
+      authentication.openshift.enabled: false
+      authentication.oauth2.enabled: true
+    asserts:
+    - exists:
+        path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')]
+    - equal:
+        path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].image
+        value: ""
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      core.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      nodeSelector:
+        disktype: hdd
+      core.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      core.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      core.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      core.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      core.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      core.image.tag: "4.0.2"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].imagePullPolicy
+          value: IfNotPresent
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].imagePullPolicy
+          value: IfNotPresent
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].imagePullPolicy
+          value: IfNotPresent
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
+          value: IfNotPresent
+
+  - it: should verify image pull policies for release versions
+    set:
+      core.image.tag: "4.1.0"
+      core.image.pullPolicy: "IfNotPresent"
+      oauth2Proxy.image.pullPolicy: "IfNotPresent"
+      grafana.image.pullPolicy: "IfNotPresent"
+      db.image.pullPolicy: "IfNotPresent"
+      datasource.image.pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should add volume mounts for declarative event templates
+    set:
+      core.config.eventTemplates.configMapNames: ['a', 'b']
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].volumeMounts
+          value:
+            - name: a
+              mountPath: /opt/cryostat.d/templates.d/a
+              readOnly: true
+            - name: b
+              mountPath: /opt/cryostat.d/templates.d/b
+              readOnly: true
+      - equal:
+          path: spec.template.spec.volumes
+          value:
+            - name: alpha-config
+              configMap:
+                name: RELEASE-NAME-alpha-config
+            - name: a
+              configMap:
+                name: a
+            - name: b
+              configMap:
+                name: b
+
+  - it: should add volume mounts for declarative TLS truststore
+    set:
+      core.config.tlsTruststore.secretNames: ['a', 'b']
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].volumeMounts
+          value:
+            - name: a
+              mountPath: /truststore/a
+              readOnly: true
+            - name: b
+              mountPath: /truststore/b
+              readOnly: true
+      - equal:
+          path: spec.template.spec.volumes
+          value:
+            - name: alpha-config
+              configMap:
+                name: RELEASE-NAME-alpha-config
+            - name: a
+              secret:
+                secretName: a
+            - name: b
+              secret:
+                secretName: b
+
+  - it: should set default podAnnotations
+    set:
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      core.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      core.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_service_test.yaml
new file mode 100644
index 000000000..810a38038
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_service_test.yaml
@@ -0,0 +1,195 @@
+suite: test cryostat_service.yaml
+templates:
+  - cryostat_service.yaml
+
+tests:
+  - it: should create a Service with the correct settings
+    set:
+      core.service.type: ClusterIP
+      core.service.httpPort: 8080
+      authentication.openshift.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - lengthEqual:
+          path: spec.ports
+          count: 1
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 4180
+      - equal:
+          path: spec.ports[0].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[0].appProtocol
+          value: http
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should create a Service with the correct settings when OpenShift authentication is enabled
+    set:
+      authentication.openshift.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - lengthEqual:
+          path: spec.ports
+          count: 2
+      - equal:
+          path: spec.ports[0].port
+          value: 8181
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 4180
+      - equal:
+          path: spec.ports[0].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[1].port
+          value: 443
+      - equal:
+          path: spec.ports[1].targetPort
+          value: 8443
+      - equal:
+          path: spec.ports[1].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[1].name
+          value: https
+      - equal:
+          path: spec.ports[1].appProtocol
+          value: https
+      - equal:
+          path: spec.selector
+          value:
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: metadata.annotations
+          value:
+            service.alpha.openshift.io/serving-cert-secret-name: RELEASE-NAME-proxy-tls
+
+  - it: should include OpenShift specific annotations when OpenShift auth is enabled
+    set:
+      authentication.openshift.enabled: true
+    asserts:
+      - exists:
+          path: metadata.annotations
+      - equal:
+          path: metadata.annotations
+          value:
+            service.alpha.openshift.io/serving-cert-secret-name: RELEASE-NAME-proxy-tls
+
+  - it: should not include OpenShift specific annotations when OpenShift auth is disabled
+    set:
+      authentication.openshift.enabled: false
+    asserts:
+      - notExists:
+          path: metadata.annotations.`service.alpha.openshift.io/serving-cert-secret-name`
+
+  - it: should create a Service with the correct settings when oauth2-proxy self-signed TLS is enabled
+    set:
+      oauth2Proxy.tls.selfSigned.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - lengthEqual:
+          path: spec.ports
+          count: 2
+      - equal:
+          path: spec.ports[0].port
+          value: 8181
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 4180
+      - equal:
+          path: spec.ports[0].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[1].port
+          value: 443
+      - equal:
+          path: spec.ports[1].targetPort
+          value: 8443
+      - equal:
+          path: spec.ports[1].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[1].name
+          value: https
+      - equal:
+          path: spec.selector
+          value:
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/component: cryostat
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_tls_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_tls_secret_test.yaml
new file mode 100644
index 000000000..be6a8f902
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/cryostat_tls_secret_test.yaml
@@ -0,0 +1,46 @@
+suite: test cryostat_tls_secret.yaml
+templates:
+  - cryostat_tls_secret.yaml
+
+tests:
+  - it: should create a TLS cert secret if oauth2Proxy.tls.selfSigned.enabled is set
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-oauth2proxy-tls
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.key
+      - exists:
+          path: data.cert
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: 4.0.2-redhat
+            helm.sh/chart: cryostat-2.0.2
+
+  - it: should not create a TLS cert secret if oauth2Proxy.tls.selfSigned.enabled is not set
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_deployment_test.yaml
new file mode 100644
index 000000000..52c4d60d7
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_deployment_test.yaml
@@ -0,0 +1,364 @@
+suite: test db_deployment.yaml
+templates:
+  - db_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4-db
+      - equal:
+          path: spec.replicas
+          value: 1
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+      - notExists:
+          path: spec.template.spec.serviceAccountName
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.2-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate cryostat-db settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].image
+          value: "registry.redhat.io/cryostat/cryostat-db-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='POSTGRESQL_USER')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='POSTGRESQL_PASSWORD')].valueFrom.secretKeyRef
+          value:
+              name: "RELEASE-NAME-db"
+              key: "CONNECTION_KEY"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='POSTGRESQL_DATABASE')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='PG_ENCRYPT_KEY')].valueFrom.secretKeyRef
+          value:
+              name: "RELEASE-NAME-db"
+              key: "ENCRYPTION_KEY"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].ports[0].containerPort
+          value: 5432
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[0].mountPath
+          value: "/var/lib/pgsql/data"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[0].name
+          value: "cryostat-db"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[0].subPath
+          value: "postgres"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].readinessProbe.exec.command
+          value:
+              - pg_isready
+              - -U
+              - cryostat
+              - -d
+              - cryostat
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].resources
+          value:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+
+  - it: should set resource overrides
+    set:
+      db:
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].resources
+          value:
+            limits:
+              cpu: 2000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set PersistentVolumeClaim (pvc) reference
+    set:
+      db:
+        pvc:
+          enabled: true
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+          value:
+            name: cryostat-db
+            persistentVolumeClaim:
+              claimName: RELEASE-NAME-db
+
+  - it: should validate volumes and volume mounts
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+          value:
+            name: cryostat-db
+            emptyDir: {}
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[?(@.mountPath=='/var/lib/pgsql/data')]
+
+  - it: should set image pull secrets if specified
+    set:
+      imagePullSecrets:
+        - name: myregistrykey
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: "myregistrykey"
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      db.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      nodeSelector:
+        disktype: hdd
+      db.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      db.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      db.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      db.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      db.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      core.image.tag: "4.0.2-snapshot"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].imagePullPolicy
+          value: "Always"
+
+  - it: should verify image pull policies for release versions
+    set:
+      db.image.pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should set default podAnnotations
+    set:
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      db.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      db.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_pvc_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_pvc_test.yaml
new file mode 100644
index 000000000..e70ecd0ad
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_pvc_test.yaml
@@ -0,0 +1,57 @@
+suite: test db_pvc.yaml
+templates:
+  - db_pvc.yaml
+
+tests:
+  - it: should create a PersistentVolumeClaim with correct settings
+    set:
+      db.pvc:
+        enabled: true
+        storage: "10Gi"
+        accessModes:
+          - "ReadWriteOnce"
+        storageClassName: "standard"
+        annotations:
+          "volume.beta.kubernetes.io/storage-class": "standard"
+        selector:
+          matchLabels:
+            app: cryostat
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat-db"
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+      - equal:
+          path: spec.accessModes
+          value:
+            - "ReadWriteOnce"
+      - equal:
+          path: spec.resources.requests.storage
+          value: "10Gi"
+      - equal:
+          path: spec.storageClassName
+          value: "standard"
+      - equal:
+          path: spec.selector.matchLabels.app
+          value: "cryostat"
+
+  - it: should not create a PersistentVolumeClaim when PVC is disabled
+    set:
+      db.pvc:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_secret_test.yaml
new file mode 100644
index 000000000..1a28fdd48
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_secret_test.yaml
@@ -0,0 +1,40 @@
+suite: test db_secret.yaml
+templates:
+  - db_secret.yaml
+
+tests:
+  - it: should create a database secret if core.databaseSecretName is not set
+    set:
+      core.databaseSecretName: ""
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-db
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.ENCRYPTION_KEY
+      - exists:
+          path: data.CONNECTION_KEY
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.2-redhat
+            helm.sh/chart: cryostat-2.0.2
+
+  - it: should not create a database secret if core.databaseSecretName is set
+    set:
+      core.databaseSecretName: "custom-db-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_service_test.yaml
new file mode 100644
index 000000000..78b892a2c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/db_service_test.yaml
@@ -0,0 +1,61 @@
+suite: test db_service.yaml
+templates:
+  - db_service.yaml
+
+tests:
+  - it: should create a Service with the correct default settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-db
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 5432
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should create a Service with the correct settings overrides
+    set:
+      db.service.type: NodeIP
+      db.service.port: 8080
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-db
+      - equal:
+          path: spec.type
+          value: NodeIP
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/ingress_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/ingress_test.yaml
new file mode 100644
index 000000000..f822dd159
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/ingress_test.yaml
@@ -0,0 +1,60 @@
+suite: test ingress.yaml
+templates:
+  - ingress.yaml
+
+tests:
+  - it: should create an Ingress with default settings
+    set:
+      core.ingress.enabled: true
+      core.service.httpPort: 8080
+      core:
+        ingress:
+          className: nginx
+          annotations:
+            nginx.ingress.kubernetes.io/rewrite-target: /
+          hosts:
+            - host: example.com
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - hosts:
+                - example.com
+              secretName: example-tls
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Ingress
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+      - equal:
+          path: metadata.annotations['nginx.ingress.kubernetes.io/rewrite-target']
+          value:  "/"
+      - equal:
+          path: spec.rules[0].host
+          value: "example.com"
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: "/"
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.port.number
+          value: 8080
+      - equal:
+          path: spec.ingressClassName
+          value: "nginx"
+      - equal:
+          path: spec.tls[0].secretName
+          value: "example-tls"
+
+  - it: should not create an Ingress when ingress is disabled
+    set:
+      core.ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/networkpolicy_ingress_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/networkpolicy_ingress_test.yaml
new file mode 100644
index 000000000..22c7a2bf6
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/networkpolicy_ingress_test.yaml
@@ -0,0 +1,148 @@
+suite: test networkpolicy_ingress.yaml
+templates:
+  - networkpolicy_ingress.yaml
+
+tests:
+  - it: should do nothing if disabled
+    set:
+      networkPolicy.ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create policy objects
+    asserts:
+      - hasDocuments:
+          count: 4
+
+  - it: should create a Cryostat access policy
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: cryostat
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector: {}
+              ports:
+                - protocol: TCP
+                  port: 4180
+                - protocol: TCP
+                  port: 8443
+
+  - it: should create a report generator access policy
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-reports-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: reports
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: NAMESPACE
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/component: cryostat
+                    app.kubernetes.io/instance: RELEASE-NAME
+                    app.kubernetes.io/name: cryostat
+                    app.kubernetes.io/part-of: cryostat
+              ports:
+                - protocol: TCP
+                  port: 4180
+                - protocol: TCP
+                  port: 8443
+
+  - it: should create a database access policy
+    documentIndex: 2
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-db-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: db
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: NAMESPACE
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/component: cryostat
+                    app.kubernetes.io/instance: RELEASE-NAME
+                    app.kubernetes.io/name: cryostat
+                    app.kubernetes.io/part-of: cryostat
+              ports:
+                - protocol: TCP
+                  port: 5432
+
+  - it: should create a storage access policy
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-storage-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: storage
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: NAMESPACE
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/component: cryostat
+                    app.kubernetes.io/instance: RELEASE-NAME
+                    app.kubernetes.io/name: cryostat
+                    app.kubernetes.io/part-of: cryostat
+              ports:
+                - protocol: TCP
+                  port: 8333
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/notes_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/notes_test.yaml
new file mode 100644
index 000000000..dfaf5259f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/notes_test.yaml
@@ -0,0 +1,164 @@
+suite: test NOTES.txt
+templates:
+  - NOTES.txt
+
+tests:
+  - it: should render correct notes for enabled ingress
+    set:
+      core.ingress.enabled: true
+      core:
+        ingress:
+          className: nginx
+          hosts:
+            - host: example.com
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - hosts:
+                - example.com
+              secretName: example-tls
+    asserts:
+      - equalRaw:
+          value: |
+
+
+            1. Visit the application at:
+              ```
+              https://example.com/
+              ```
+
+  - it: should render correct notes for enabled route without TLS
+    set:
+      core.route.enabled: true
+      core.route.tls.enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Visit the application at:
+              ```
+              echo http://$(oc get route -n NAMESPACE RELEASE-NAME-cryostat -o jsonpath="{.status.ingress[0].host}")
+              ```
+
+  - it: should render correct notes for enabled route with TLS
+    set:
+      core.route.enabled: true
+      core.route.tls.enabled: true
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Visit the application at:
+              ```
+              echo https://$(oc get route -n NAMESPACE RELEASE-NAME-cryostat -o jsonpath="{.status.ingress[0].host}")
+              ```
+
+  - it: should render correct notes for NodePort service without ingress or route
+    set:
+      core.service.type: "NodePort"
+      core.ingress.enabled: false
+      core.route.enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              export NODE_IP=$(kubectl get nodes -n NAMESPACE -o jsonpath="{.items[0].status.addresses[0].address}")
+              export NODE_PORT=$(kubectl get -n NAMESPACE -o jsonpath="{.spec.ports[0].nodePort}" services RELEASE-NAME-cryostat)
+              kubectl -n NAMESPACE set env deploy --containers=cryostat RELEASE-NAME-cryostat-v4 QUARKUS_HTTP_HOST=$NODE_IP
+              ```
+
+            2. Visit the application at:
+              ```
+              echo http://$NODE_IP:$NODE_PORT
+              ```
+
+  - it: should render correct notes for LoadBalancer service without ingress or route
+    set:
+      core.service.type: "LoadBalancer"
+      core.ingress.enabled: false
+      core.route.enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+                 NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+                       You can watch the status by running 'kubectl get -n NAMESPACE -w svc/RELEASE-NAME-cryostat'
+              export SERVICE_IP=$(kubectl get svc -n NAMESPACE RELEASE-NAME-cryostat --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
+              kubectl -n NAMESPACE set env deploy --containers=cryostat RELEASE-NAME-cryostat-v4 QUARKUS_HTTP_HOST=$SERVICE_IP
+              ```
+
+            2. Visit the application at:
+              ```
+              echo http://$SERVICE_IP:8181
+              ```
+
+  - it: should render correct notes for ClusterIP service without ingress or route and TLS enabled
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: true
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Forward local port to the application's service:
+              ```
+              kubectl -n NAMESPACE wait --for=condition=available --timeout=60s deploy/RELEASE-NAME-cryostat-v4
+
+              export SVC_NAME=$(kubectl get services -n NAMESPACE -l "app.kubernetes.io/name=cryostat,app.kubernetes.io/instance=RELEASE-NAME,app.kubernetes.io/component=cryostat" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
+              kubectl -n NAMESPACE port-forward svc/$SVC_NAME 8443:https
+              ```
+
+            3. Visit the application at:
+              ```
+              https://localhost:8443
+              ```
+
+  - it: should render correct notes for ClusterIP service without ingress or route and TLS disabled
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Forward local port to the application's service:
+              ```
+              kubectl -n NAMESPACE wait --for=condition=available --timeout=60s deploy/RELEASE-NAME-cryostat-v4
+
+              export SVC_NAME=$(kubectl get services -n NAMESPACE -l "app.kubernetes.io/name=cryostat,app.kubernetes.io/instance=RELEASE-NAME,app.kubernetes.io/component=cryostat" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
+              kubectl -n NAMESPACE port-forward svc/$SVC_NAME 8080:http
+              ```
+
+            3. Visit the application at:
+              ```
+              http://localhost:8080
+              ```
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_deployment_test.yaml
new file mode 100644
index 000000000..446edf756
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_deployment_test.yaml
@@ -0,0 +1,316 @@
+suite: test reports_deployment.yaml
+templates:
+  - reports_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings when disabled
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should verify general deployment settings when enabled
+    set:
+      reports:
+        replicas: 2
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4-reports
+      - equal:
+          path: spec.replicas
+          value: 2
+      - equal:
+          path: spec.strategy.type
+          value: RollingUpdate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: reports
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/component: reports
+      - notExists:
+          path: spec.template.spec.serviceAccountName
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.2-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: reports
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate all container settings including environment variables and security contexts
+    set:
+      reports:
+        replicas: 1
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].ports
+          value:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].image
+          value: "registry.redhat.io/cryostat/cryostat-reports-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].env[?(@.name=='QUARKUS_HTTP_PORT')].value
+          value: "10001"
+
+  - it: should validate authproxy settings when deployed in OpenShift
+    set:
+      reports:
+        replicas: 1
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].ports
+          value:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+            - containerPort: 8443
+              name: https
+              protocol: TCP
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      reports:
+        replicas: 1
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      reports.replicas: 1
+      reports.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      reports.replicas: 1
+      nodeSelector:
+        disktype: hdd
+      reports.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      reports.replicas: 1
+      reports.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      reports.replicas: 1
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      reports.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      reports.replicas: 1
+      reports.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      reports.replicas: 1
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      reports.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      reports:
+        replicas: 1
+        image:
+          tag: "4.0.2-snapshot"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].imagePullPolicy
+          value: "Always"
+
+  - it: should verify image pull policies for release versions
+    set:
+      reports:
+        replicas: 1
+        image:
+          tag: "4.1.0"
+          pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should set default podAnnotations
+    set:
+      reports.replicas: 1
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      reports.replicas: 1
+      reports.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      reports.replicas: 1
+      reports.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_secret_test.yaml
new file mode 100644
index 000000000..05e9ecf57
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_secret_test.yaml
@@ -0,0 +1,40 @@
+suite: test reports_secret.yaml
+templates:
+  - reports_secret.yaml
+
+tests:
+  - it: should create a reports secret if core.reportsSecretName is not set
+    set:
+      core.reportsSecretName: ""
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-reports-secret
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.htpasswd
+      - exists:
+          path: data.REPORTS_PASS
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: 4.0.2-redhat
+            helm.sh/chart: cryostat-2.0.2
+
+  - it: should not create a database secret if reports.reportsSecretName is set
+    set:
+      reports.reportsSecretName: "custom-reports-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_service_test.yaml
new file mode 100644
index 000000000..1b346dbbf
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/reports_service_test.yaml
@@ -0,0 +1,78 @@
+suite: test reports_service.yaml
+templates:
+  - reports_service.yaml
+
+tests:
+  - it: should do nothing if report generators are not desired
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create a Service targeting the Pod http port
+    set:
+      reports:
+        replicas: 1
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-reports
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 10001
+      - equal:
+          path: spec.ports[0].targetPort
+          value: http
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: reports
+
+  - it: should create a Service targeting the Pod https port when deployed in OpenShift
+    set:
+      reports:
+        replicas: 1
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-reports
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 10001
+      - equal:
+          path: spec.ports[0].targetPort
+          value: https
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: reports
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/role_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/role_test.yaml
new file mode 100644
index 000000000..8336fa566
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/role_test.yaml
@@ -0,0 +1,143 @@
+suite: test role.yaml
+templates:
+  - role.yaml
+
+tests:
+  - it: should create Roles in target namespace
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces:
+        - "default"
+        - "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 2
+      - equal:
+          path: kind
+          value: Role
+      - equal:
+          path: metadata.namespace
+          value: "default"
+        documentIndex: 0
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        documentIndex: 1
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+        documentIndex: 0
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+        documentIndex: 1
+
+  - it: should have correct permissions for endpoints, pods, and other resources
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces:
+        - "default"
+    asserts:
+      - equal:
+          path: rules[0].apiGroups
+          value: [""]
+      - equal:
+          path: rules[0].resources
+          value: ["endpoints"]
+      - equal:
+          path: rules[0].verbs
+          value: ["get", "list", "watch"]
+      - equal:
+          path: rules[1].apiGroups
+          value: [""]
+      - equal:
+          path: rules[1].resources
+          value: ["pods", "replicationcontrollers"]
+      - equal:
+          path: rules[1].verbs
+          value: ["get"]
+      - equal:
+          path: rules[2].apiGroups
+          value: ["apps"]
+      - equal:
+          path: rules[2].resources
+          value: ["replicasets", "deployments", "daemonsets", "statefulsets"]
+      - equal:
+          path: rules[2].verbs
+          value: ["get"]
+      - equal:
+          path: rules[3].apiGroups
+          value: ["apps.openshift.io"]
+      - equal:
+          path: rules[3].resources
+          value: ["deploymentconfigs"]
+      - equal:
+          path: rules[3].verbs
+          value: ["get"]
+      - equal:
+          path: rules[4].apiGroups
+          value: ["route.openshift.io"]
+      - equal:
+          path: rules[4].verbs
+          value: ["get", "list"]
+      - equal:
+          path: rules[4].resources
+          value: ["routes"]
+
+  - it: should not create any Role if RBAC is disabled
+    set:
+      rbac.create: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create any Roles when Kubernetes discovery is disabled
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not specify a namespace if installNamespaceDisabled is true
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.installNamespaceDisabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should specify the default namespace if installNamespaceDisabled is false
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.installNamespaceDisabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.namespace
+          value: "NAMESPACE"
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/rolebinding_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/rolebinding_test.yaml
new file mode 100644
index 000000000..05d368453
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/rolebinding_test.yaml
@@ -0,0 +1,124 @@
+suite: test rolebinding.yaml
+templates:
+  - rolebinding.yaml
+
+tests:
+  - it: should create a RoleBinding in the default namespace
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces:
+        - "default"
+        - "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 2
+      - equal:
+          path: kind
+          value: RoleBinding
+        documentIndex: 0
+      - equal:
+          path: kind
+          value: RoleBinding
+        documentIndex: 1
+      - equal:
+          path: metadata.namespace
+          value: "default"
+        documentIndex: 0
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        documentIndex: 1
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: roleRef.apiGroup
+          value: "rbac.authorization.k8s.io"
+        documentIndex: 0
+      - equal:
+          path: roleRef.apiGroup
+          value: "rbac.authorization.k8s.io"
+        documentIndex: 1
+      - equal:
+          path: roleRef.kind
+          value: "Role"
+        documentIndex: 0
+      - equal:
+          path: roleRef.kind
+          value: "Role"
+        documentIndex: 1
+      - matchRegex:
+          path: roleRef.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: roleRef.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: subjects[0].kind
+          value: "ServiceAccount"
+        documentIndex: 0
+      - equal:
+          path: subjects[0].kind
+          value: "ServiceAccount"
+        documentIndex: 1
+      - matchRegex:
+          path: subjects[0].name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: subjects[0].name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: subjects[0].namespace
+          value: "NAMESPACE"
+        documentIndex: 0
+      - equal:
+          path: subjects[0].namespace
+          value: "NAMESPACE"
+        documentIndex: 1
+
+  - it: should not create any RoleBinding if RBAC is disabled
+    set:
+      rbac.create: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create any RoleBinding when Kubernetes discovery is disabled
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: false
+    asserts:
+    - hasDocuments:
+        count: 0
+
+  - it: should not create any RoleBinding if installNamespaceDisabled is true
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.installNamespaceDisabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create a RoleBinding in the default namespace if installNamespaceDisabled is false
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces: []
+      core.discovery.kubernetes.installNamespaceDisabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.namespace
+          value: "NAMESPACE"
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/route_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/route_test.yaml
new file mode 100644
index 000000000..f91b1ac1d
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/route_test.yaml
@@ -0,0 +1,75 @@
+suite: test route.yaml
+templates:
+  - route.yaml
+
+tests:
+  - it: should create a Route when routing is enabled
+    set:
+      core.route.enabled: true
+      core:
+        route:
+          annotations:
+            hello: world
+          tls:
+            enabled: true
+            termination: edge
+            insecureEdgeTerminationPolicy: Redirect
+            key: "RSA PRIVATE KEY"
+            destinationCACertificate: "DESTINATION CA"
+            caCertificate: "CA CERT"
+            certificate: "CERT"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Route
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+      - equal:
+          path: metadata.annotations.hello
+          value: "world"
+      - equal:
+          path: spec.to.kind
+          value: "Service"
+      - equal:
+          path: spec.to.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: spec.port.targetPort
+          value: 4180
+      - equal:
+          path: spec.tls.termination
+          value: "edge"
+      - equal:
+          path: spec.tls.insecureEdgeTerminationPolicy
+          value: "Redirect"
+      - matchRegex:
+          path: spec.tls.key
+          pattern: ".*RSA PRIVATE KEY.*"
+      - matchRegex:
+          path: spec.tls.destinationCACertificate
+          pattern: ".*DESTINATION CA.*"
+      - matchRegex:
+          path: spec.tls.caCertificate
+          pattern: ".*CA CERT.*"
+      - matchRegex:
+          path: spec.tls.certificate
+          pattern: ".*CERT.*"
+
+  - it: should not create a Route when routing is disabled
+    set:
+      core.route.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/serviceaccount_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/serviceaccount_test.yaml
new file mode 100644
index 000000000..211aa9b37
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/serviceaccount_test.yaml
@@ -0,0 +1,37 @@
+suite: test serviceaccount.yaml
+templates:
+  - serviceaccount.yaml
+
+tests:
+  - it: should create a ServiceAccount with OpenShift redirect annotations when OpenShift auth is enabled
+    set:
+      authentication.openshift.enabled: true
+      serviceAccount.create: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: ServiceAccount
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: metadata.annotations
+          value:
+            serviceaccounts.openshift.io/oauth-redirectreference.primary: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"RELEASE-NAME-cryostat"}}'
+
+  - it: should not include OpenShift specific annotations when OpenShift auth is disabled
+    set:
+      authentication.openshift.enabled: false
+      serviceAccount.create: true
+    asserts:
+      - notExists:
+          path: metadata.annotations
+
+  - it: should not create a ServiceAccount when serviceAccount.create is disabled
+    set:
+      serviceAccount.create: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_deployment_test.yaml
new file mode 100644
index 000000000..3c92f208c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_deployment_test.yaml
@@ -0,0 +1,393 @@
+suite: test storage_deployment.yaml
+templates:
+  - storage_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4-storage
+      - equal:
+          path: spec.replicas
+          value: 1
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+      - notExists:
+          path: spec.template.spec.serviceAccountName
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.2-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate cryostat-storage settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].image
+          value: "registry.redhat.io/cryostat/cryostat-storage-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_BUCKETS')].value
+          value: "archivedrecordings,archivedreports,eventtemplates,probes"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_ACCESS_KEY')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_SECRET_KEY')].valueFrom.secretKeyRef
+          value:
+              name: "RELEASE-NAME-storage-secret"
+              key: "STORAGE_ACCESS_KEY"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='DATA_DIR')].value
+          value: "/data"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='IP_BIND')].value
+          value: 0.0.0.0
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='REST_ENCRYPTION_ENABLE')].value
+          value: "1"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].ports[0].containerPort
+          value: 8333
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[0].mountPath
+          value: "/data"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[0].name
+          value: "cryostat-storage"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[0].subPath
+          value: "seaweed"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.httpGet.path
+          value: "/status"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.httpGet.port
+          value: 8333
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.periodSeconds
+          value: 10
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.failureThreshold
+          value: 2
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.httpGet.path
+          value: "/status"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.httpGet.port
+          value: 8333
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.periodSeconds
+          value: 10
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.failureThreshold
+          value: 9
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].resources
+          value:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+
+  - it: should allow disabling at-rest encryption
+    set:
+      storage:
+        encryption:
+          enabled: false
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='REST_ENCRYPTION_ENABLE')].value
+          value: "0"
+
+  - it: should set resource overrides
+    set:
+      storage:
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].resources
+          value:
+            limits:
+              cpu: 2000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set PersistentVolumeClaim (pvc) reference
+    set:
+      storage:
+        pvc:
+          enabled: true
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+          value:
+            name: cryostat-storage
+            persistentVolumeClaim:
+              claimName: RELEASE-NAME-storage
+
+  - it: should validate volumes and volume mounts
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+          value:
+            name: cryostat-storage
+            emptyDir: {}
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[?(@.mountPath=='/data')]
+
+  - it: should set image pull secrets if specified
+    set:
+      imagePullSecrets:
+        - name: myregistrykey
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: "myregistrykey"
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      storage.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      nodeSelector:
+        disktype: hdd
+      storage.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      storage.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      storage.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      storage.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      storage.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      core.image.tag: "4.0.2-snapshot"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].imagePullPolicy
+          value: "Always"
+
+  - it: should verify image pull policies for release versions
+    set:
+      storage.image.pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should set default podAnnotations
+    set:
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      storage.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      storage.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_pvc_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_pvc_test.yaml
new file mode 100644
index 000000000..9448cac7e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_pvc_test.yaml
@@ -0,0 +1,57 @@
+suite: test storage_pvc.yaml
+templates:
+  - storage_pvc.yaml
+
+tests:
+  - it: should create a PersistentVolumeClaim with correct settings
+    set:
+      storage.pvc:
+        enabled: true
+        storage: "10Gi"
+        accessModes:
+          - "ReadWriteOnce"
+        storageClassName: "standard"
+        annotations:
+          "volume.beta.kubernetes.io/storage-class": "standard"
+        selector:
+          matchLabels:
+            app: cryostat
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat-storage"
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+      - equal:
+          path: spec.accessModes
+          value:
+            - "ReadWriteOnce"
+      - equal:
+          path: spec.resources.requests.storage
+          value: "10Gi"
+      - equal:
+          path: spec.storageClassName
+          value: "standard"
+      - equal:
+          path: spec.selector.matchLabels.app
+          value: "cryostat"
+
+  - it: should not create a PersistentVolumeClaim when PVC is disabled
+    set:
+      storage.pvc:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_secret_test.yaml
new file mode 100644
index 000000000..d5ebc6c81
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_secret_test.yaml
@@ -0,0 +1,36 @@
+suite: test storage_secret.yaml
+templates:
+  - storage_secret.yaml
+
+tests:
+  - it: should create a Storage Access Secret with correct settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-storage-secret
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.STORAGE_ACCESS_KEY
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.2-redhat
+            helm.sh/chart: cryostat-2.0.2
+
+  - it: should not create a storage secret if storage.storageSecretName is set
+    set:
+      storage.storageSecretName: "custom-storage-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_service_test.yaml
new file mode 100644
index 000000000..8a5d04332
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/tests/storage_service_test.yaml
@@ -0,0 +1,62 @@
+suite: test storage_service.yaml
+templates:
+  - storage_service.yaml
+
+tests:
+  - it: should create a Service with the correct default settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-storage
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 8333
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should create a Service with the correct settings overrides
+    set:
+      storage.service.type: NodeIP
+      storage.service.port: 8080
+      authentication.openshift.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-storage
+      - equal:
+          path: spec.type
+          value: NodeIP
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.2-redhat"
+            helm.sh/chart: cryostat-2.0.2
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/values.schema.json b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/values.schema.json
new file mode 100644
index 000000000..39dfa6859
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/values.schema.json
@@ -0,0 +1,1160 @@
+{
+    "title": "Chart Values",
+    "type": "object",
+    "properties": {
+        "core": {
+            "type": "object",
+            "properties": {
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the main Cryostat container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the main Cryostat container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the main Cryostat container image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the Cryostat application",
+                            "default": "ClusterIP"
+                        },
+                        "httpPort": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service for Cryostat's HTTP server",
+                            "default": 8181
+                        }
+                    }
+                },
+                "debug": {
+                    "type": "object",
+                    "properties": {
+                        "log": {
+                            "type": "object",
+                            "properties": {
+                                "level": {
+                                    "type": "string",
+                                    "description": "Log level for troubleshooting and debugging",
+                                    "default": "INFO"
+                                }
+                            }
+                        }
+                    }
+                },
+                "sslProxied": {
+                    "type": "boolean",
+                    "description": "Enables SSL Proxied Environment Variables, useful when you are offloading SSL/TLS at External Loadbalancer instead of Ingress",
+                    "default": false
+                },
+                "ingress": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether to create an Ingress object for the Cryostat service",
+                            "default": false
+                        },
+                        "className": {
+                            "type": "string",
+                            "description": "Ingress class name for the Cryostat application Ingress",
+                            "default": ""
+                        },
+                        "hosts": {
+                            "type": "array",
+                            "description": "",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "host": {
+                                        "type": "string",
+                                        "description": ""
+                                    },
+                                    "paths": {
+                                        "type": "array",
+                                        "description": "",
+                                        "items": {
+                                            "type": "object",
+                                            "properties": {
+                                                "path": {
+                                                    "type": "string",
+                                                    "description": ""
+                                                },
+                                                "pathType": {
+                                                    "type": "string",
+                                                    "description": ""
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        },
+                        "tls": {
+                            "type": "array",
+                            "description": "TLS configuration for the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)",
+                            "default": [],
+                            "items": {}
+                        }
+                    }
+                },
+                "route": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether to create a Route object for the Cryostat service. Available only on OpenShift",
+                            "default": true
+                        },
+                        "tls": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Whether to secure the Cryostat application Route with TLS. See: [TLSConfig](https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/route-route-openshift-io-v1.html#spec-tls)",
+                                    "default": true
+                                },
+                                "termination": {
+                                    "type": "string",
+                                    "description": "Type of TLS termination to use for the Cryostat application Route. One of: `edge`, `passthrough`, `reencrypt`",
+                                    "default": "edge"
+                                },
+                                "insecureEdgeTerminationPolicy": {
+                                    "type": "string",
+                                    "description": "Specify how to handle insecure traffic for the Cryostat application Route. One of: `Allow`, `Disable`, `Redirect`",
+                                    "default": "Redirect"
+                                },
+                                "key": {
+                                    "type": "string",
+                                    "description": "Custom private key to use when securing the Cryostat application Route",
+                                    "default": ""
+                                },
+                                "certificate": {
+                                    "type": "string",
+                                    "description": "Custom certificate to use when securing the Cryostat application Route",
+                                    "default": ""
+                                },
+                                "caCertificate": {
+                                    "type": "string",
+                                    "description": "Custom CA certificate to use, if needed to complete the certificate chain, when securing the Cryostat application Route",
+                                    "default": ""
+                                },
+                                "destinationCACertificate": {
+                                    "type": "string",
+                                    "description": "Provides the contents of the CA certificate of the final destination when using reencrypt termination for the Cryostat application Route",
+                                    "default": ""
+                                }
+                            }
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "500m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the Cryostat container.",
+                                    "default": "384Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "databaseSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data stored within the database, such as the target credentials keyring. It must not be updated across chart upgrades. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "discovery": {
+                    "type": "object",
+                    "properties": {
+                        "kubernetes": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Enables Kubernetes API discovery mechanism",
+                                    "default": true
+                                },
+                                "installNamespaceDisabled": {
+                                    "type": "boolean",
+                                    "description": "When false and `namespaces` is empty, the Cryostat application will default to discovery targets in the install namespace (i.e. `{{ .Release.Namespace }}`)",
+                                    "default": false
+                                },
+                                "namespaces": {
+                                    "type": "array",
+                                    "description": "List of namespaces whose workloads the Cryostat application should be permitted to access and profile",
+                                    "default": [],
+                                    "items": {}
+                                },
+                                "builtInPortNamesDisabled": {
+                                    "type": "boolean",
+                                    "description": "When false and `portNames` is empty, the Cryostat application will use the default port name `jfr-jmx` to look for JMX connectable targets.",
+                                    "default": false
+                                },
+                                "portNames": {
+                                    "type": "array",
+                                    "description": "List of port names that the Cryostat application should look for in order to consider a target as JMX connectable",
+                                    "default": [],
+                                    "items": {}
+                                },
+                                "builtInPortNumbersDisabled": {
+                                    "type": "boolean",
+                                    "description": "When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.",
+                                    "default": false
+                                },
+                                "portNumbers": {
+                                    "type": "array",
+                                    "description": "List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        }
+                    }
+                },
+                "config": {
+                    "type": "object",
+                    "properties": {
+                        "eventTemplates": {
+                            "type": "object",
+                            "properties": {
+                                "configMapNames": {
+                                    "type": "array",
+                                    "description": "List of ConfigMap names. Each ConfigMap is expected to contain one or more files, which are .jfc (XML) JFR Event Templates, to be mounted to the Cryostat container.",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        },
+                        "tlsTruststore": {
+                            "type": "object",
+                            "properties": {
+                                "secretNames": {
+                                    "type": "array",
+                                    "description": "List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Cryostat Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "reports": {
+            "type": "object",
+            "properties": {
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the Report Generator container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-reports-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the Report Generator container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the Report Generator image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the Report Generator Deployment",
+                            "default": "ClusterIP"
+                        },
+                        "httpPort": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service for the Report Generator Deployment",
+                            "default": 10001
+                        }
+                    }
+                },
+                "reportsSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the report generator access keys. This secret must contain a REPORTS_PASS secret which is the secret credential for the report generators. It must not be updated across chart upgrades, or else the connection between Cryostat and report generators will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "debug": {
+                    "type": "object",
+                    "properties": {
+                        "log": {
+                            "type": "object",
+                            "properties": {
+                                "level": {
+                                    "type": "string",
+                                    "description": "Log level for troubleshooting and debugging",
+                                    "default": "INFO"
+                                }
+                            }
+                        }
+                    }
+                },
+                "replicas": {
+                    "type": "number",
+                    "description": "Number of Report Generator replicas to deploy. If zero, the Deployment and Service will not be created and the main Cryostat container will handle all report generations on its own.",
+                    "default": 0
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for each Pod in the Report Generator Deployment.",
+                                    "default": "500m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for each Pod in the Report Generator Deployment.",
+                                    "default": "512Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Report Generator Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "db": {
+            "type": "object",
+            "properties": {
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the database container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-db-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the database container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the database container image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the database",
+                            "default": "ClusterIP"
+                        },
+                        "port": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service",
+                            "default": 5432
+                        }
+                    }
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the database container.",
+                                    "default": "64Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "pvc": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.",
+                            "default": false
+                        },
+                        "storage": {
+                            "type": "string",
+                            "description": "Storage size to request for the persistentVolumeClaim",
+                            "default": "500Mi"
+                        },
+                        "accessModes": {
+                            "type": "array",
+                            "description": "Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)",
+                            "default": [
+                                "ReadWriteOnce"
+                            ],
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Database Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "storage": {
+            "type": "object",
+            "properties": {
+                "storageSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the storage container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-storage-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the storage container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the storage container image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "encryption": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enable at-rest encryption of stored objects. The storage container will generate a secret key for each stored object and use this key to encrypt and decrypt objects transparently. The key is written to the object metadata, so in the default storage container configuration this only adds a small layer of additional security.",
+                            "default": true
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the object storage",
+                            "default": "ClusterIP"
+                        },
+                        "port": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service",
+                            "default": 8333
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "50m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the object storage container.",
+                                    "default": "256Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "pvc": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.",
+                            "default": false
+                        },
+                        "storage": {
+                            "type": "string",
+                            "description": "Storage size to request for the persistentVolumeClaim",
+                            "default": "500Mi"
+                        },
+                        "accessModes": {
+                            "type": "array",
+                            "description": "Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)",
+                            "default": [
+                                "ReadWriteOnce"
+                            ],
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Storage Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "grafana": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the Grafana container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the Grafana container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the Grafana container image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for Grafana",
+                            "default": "ClusterIP"
+                        },
+                        "port": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service for Grafana's HTTP server",
+                            "default": 3000
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the Grafana container.",
+                                    "default": "80Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Grafana Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "datasource": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the JFR Data Source container image",
+                            "default": "registry.redhat.io/cryostat/jfr-datasource-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the JFR Data Source container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the JFR Data Source container image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "200m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the JFR Data Source container.",
+                                    "default": "200Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the JFR Datasource Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "oauth2Proxy": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the OAuth2 Proxy container image",
+                            "default": ""
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the OAuth2 Proxy container image",
+                            "default": "Never"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the OAuth2 Proxy container image",
+                            "default": ""
+                        }
+                    }
+                },
+                "tls": {
+                    "type": "object",
+                    "properties": {
+                        "selfSigned": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Whether a self-signed TLS certificate for oauth2-proxy HTTPS is generated and used.",
+                                    "default": false
+                                }
+                            }
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the OAuth2 Proxy container.",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the OAuth2 Proxy container.",
+                                    "default": "64Mi"
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "authentication": {
+            "type": "object",
+            "properties": {
+                "cookieSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "openshift": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.",
+                            "default": true
+                        },
+                        "clusterRole": {
+                            "type": "object",
+                            "properties": {
+                                "name": {
+                                    "type": "string",
+                                    "description": "The name of the ClusterRole to bind for the OpenShift OAuth Proxy",
+                                    "default": "system:auth-delegator"
+                                }
+                            }
+                        }
+                    }
+                },
+                "basicAuth": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether Cryostat should use basic authentication for users. When false, Cryostat will not perform any form of authentication",
+                            "default": false
+                        },
+                        "secretName": {
+                            "type": "string",
+                            "description": "Name of the Secret that contains the credentials within Cryostat's namespace **(Required if basicAuth is enabled)**",
+                            "default": ""
+                        },
+                        "filename": {
+                            "type": "string",
+                            "description": "Key within Secret containing the `htpasswd` file. The file should contain one user definition entry per line, with the syntax \"user:passHash\", where \"user\" is the username and \"passHash\" is the `bcrypt` hash of the desired password. Such an entry can be generated with ex. `htpasswd -nbB username password` **(Required if basicAuth is enabled)**",
+                            "default": ""
+                        }
+                    }
+                }
+            }
+        },
+        "openshiftOauthProxy": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the OpenShift OAuth Proxy container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the OpenShift OAuth Proxy container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the OpenShift OAuth Proxy container image",
+                            "default": "4.0.2"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the OpenShift OAuth Proxy container.",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the OpenShift OAuth Proxy container.",
+                                    "default": "64Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "accessReview": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether the SubjectAccessReview/TokenAccessReview role checks for users and clients are enabled. If this is disabled then the proxy will only check that the user has valid credentials or holds a valid token.",
+                            "default": true
+                        },
+                        "group": {
+                            "type": "string",
+                            "description": "The OpenShift resource group that the SubjectAccessReview/TokenAccessReview will be performed for. See https://github.com/openshift/oauth-proxy/?tab=readme-ov-file#delegate-authentication-and-authorization-to-openshift-for-infrastructure",
+                            "default": ""
+                        },
+                        "resource": {
+                            "type": "string",
+                            "description": "The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "pods"
+                        },
+                        "subresource": {
+                            "type": "string",
+                            "description": "The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "exec"
+                        },
+                        "name": {
+                            "type": "string",
+                            "description": "The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": ""
+                        },
+                        "namespace": {
+                            "type": "string",
+                            "description": "The OpenShift namespace that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "{{ .Release.Namespace }}"
+                        },
+                        "verb": {
+                            "type": "string",
+                            "description": "The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "create"
+                        },
+                        "version": {
+                            "type": "string",
+                            "description": "The OpenShift resource version that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": ""
+                        }
+                    }
+                }
+            }
+        },
+        "podSecurityContext": {
+            "type": "object",
+            "properties": {
+                "seccompProfile": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "",
+                            "default": "RuntimeDefault"
+                        }
+                    }
+                },
+                "runAsNonRoot": {
+                    "type": "boolean",
+                    "description": "",
+                    "default": true
+                }
+            }
+        },
+        "imagePullSecrets": {
+            "type": "array",
+            "description": "Image pull secrets to be used for the Cryostat deployment",
+            "default": [],
+            "items": {}
+        },
+        "nameOverride": {
+            "type": "string",
+            "description": "Overrides the name of this Chart",
+            "default": ""
+        },
+        "fullnameOverride": {
+            "type": "string",
+            "description": "Overrides the fully qualified application name of `[release name]-[chart name]`",
+            "default": ""
+        },
+        "rbac": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean",
+                    "description": "Specifies whether RBAC resources should be created",
+                    "default": true
+                }
+            }
+        },
+        "serviceAccount": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean",
+                    "description": "Specifies whether a service account should be created",
+                    "default": true
+                },
+                "name": {
+                    "type": "string",
+                    "description": "The name of the service account to use. If not set and create is true, a name is generated using the fullname template",
+                    "default": ""
+                }
+            }
+        },
+        "networkPolicy": {
+            "type": "object",
+            "properties": {
+                "ingress": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.",
+                            "default": true
+                        }
+                    }
+                }
+            }
+        },
+        "tolerations": {
+            "type": "array",
+            "description": "default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+            "default": [],
+            "items": {}
+        }
+    }
+}
\ No newline at end of file
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.2/src/values.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/values.yaml
new file mode 100644
index 000000000..9e584c8e3
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.2/src/values.yaml
@@ -0,0 +1,456 @@
+## @section Cryostat Container
+## @extra core Configuration for the core Cryostat application
+core:
+  image:
+    ## @param core.image.repository Repository for the main Cryostat container image
+    repository: "registry.redhat.io/cryostat/cryostat-rhel9"
+    ## @param core.image.pullPolicy Image pull policy for the main Cryostat container image
+    pullPolicy: IfNotPresent
+    ## @param core.image.tag Tag for the main Cryostat container image
+    tag: "4.0.2"
+  ## @param core.podAnnotations [object] Annotations to be applied to the Cryostat Pods
+  podAnnotations: {}
+  service:
+    ## @param core.service.type Type of Service to create for the Cryostat application
+    type: ClusterIP
+    ## @param core.service.httpPort Port number to expose on the Service for Cryostat's HTTP server
+    httpPort: 8181
+  debug:
+    log:
+      ## @param core.debug.log.level Log level for troubleshooting and debugging
+      level: INFO
+  ## @param core.sslProxied Enables SSL Proxied Environment Variables, useful when you are offloading SSL/TLS at External Loadbalancer instead of Ingress
+  sslProxied: false
+  ingress:
+    ## @param core.ingress.enabled Whether to create an Ingress object for the Cryostat service
+    enabled: false
+    ## @param core.ingress.className Ingress class name for the Cryostat application Ingress
+    className: ""
+    ## @param core.ingress.annotations [object] Annotations to apply to the Cryostat application Ingress
+    annotations: {}
+    ## @param core.ingress.hosts [array] Hosts to create rules for in the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)
+    hosts:
+      - host: cryostat.local
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+    ## @param core.ingress.tls [array] TLS configuration for the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)
+    tls: []
+  route:
+    ## @param core.route.enabled Whether to create a Route object for the Cryostat service. Available only on OpenShift
+    enabled: true
+    tls:
+      ## @param core.route.tls.enabled Whether to secure the Cryostat application Route with TLS. See: [TLSConfig](https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/route-route-openshift-io-v1.html#spec-tls)
+      enabled: true
+      ## @param core.route.tls.termination Type of TLS termination to use for the Cryostat application Route. One of: `edge`, `passthrough`, `reencrypt`
+      termination: edge
+      ## @param core.route.tls.insecureEdgeTerminationPolicy Specify how to handle insecure traffic for the Cryostat application Route. One of: `Allow`, `Disable`, `Redirect`
+      insecureEdgeTerminationPolicy: Redirect
+      ## @param core.route.tls.key Custom private key to use when securing the Cryostat application Route
+      key: ""
+      ## @param core.route.tls.certificate Custom certificate to use when securing the Cryostat application Route
+      certificate: ""
+      ## @param core.route.tls.caCertificate Custom CA certificate to use, if needed to complete the certificate chain, when securing the Cryostat application Route
+      caCertificate: ""
+      ## @param core.route.tls.destinationCACertificate Provides the contents of the CA certificate of the final destination when using reencrypt termination for the Cryostat application Route
+      destinationCACertificate: ""
+  resources:
+    requests:
+      ## @param core.resources.requests.cpu CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 500m
+      ## @param core.resources.requests.memory Memory resource request for the Cryostat container.
+      memory: 384Mi
+  ## @param core.securityContext [object] Security Context for the Cryostat container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip core.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip core.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param core.databaseSecretName Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data stored within the database, such as the target credentials keyring. It must not be updated across chart upgrades. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  databaseSecretName: ""
+  ## @extra core.discovery Configuration options to the Cryostat application's target discovery mechanisms
+  discovery:
+    kubernetes:
+      ## @param core.discovery.kubernetes.enabled Enables Kubernetes API discovery mechanism
+      enabled: true
+      ## @param core.discovery.kubernetes.installNamespaceDisabled When false and `namespaces` is empty, the Cryostat application will default to discovery targets in the install namespace (i.e. `{{ .Release.Namespace }}`)
+      installNamespaceDisabled: false
+      ## @param core.discovery.kubernetes.namespaces [array] List of namespaces whose workloads the Cryostat application should be permitted to access and profile
+      namespaces: []
+      ## @param core.discovery.kubernetes.builtInPortNamesDisabled When false and `portNames` is empty, the Cryostat application will use the default port name `jfr-jmx` to look for JMX connectable targets.
+      builtInPortNamesDisabled: false
+      ## @param core.discovery.kubernetes.portNames [array] List of port names that the Cryostat application should look for in order to consider a target as JMX connectable
+      portNames: []
+      ## @param core.discovery.kubernetes.builtInPortNumbersDisabled When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.
+      builtInPortNumbersDisabled: false
+      ## @param core.discovery.kubernetes.portNumbers [array] List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable
+      portNumbers: []
+  config:
+    eventTemplates:
+      ## @param core.config.eventTemplates.configMapNames [array] List of ConfigMap names. Each ConfigMap is expected to contain one or more files, which are .jfc (XML) JFR Event Templates, to be mounted to the Cryostat container.
+      configMapNames: []
+    tlsTruststore:
+      ## @param core.config.tlsTruststore.secretNames [array] List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.
+      secretNames: []
+  ## @param core.nodeSelector [object] Node Selector for the Cryostat Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param core.tolerations [array] Tolerations for the Cryostat Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param core.affinity [object] Affinity for the Cryostat Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Report Generator Deployment
+## @extra reports Configuration for the Reports Generator deployment
+reports:
+  image:
+    ## @param reports.image.repository Repository for the Report Generator container image
+    repository: "registry.redhat.io/cryostat/cryostat-reports-rhel9"
+    ## @param reports.image.pullPolicy Image pull policy for the Report Generator container image
+    pullPolicy: IfNotPresent
+    ## @param reports.image.tag Tag for the Report Generator image
+    tag: "4.0.2"
+  ## @param reports.podAnnotations [object] Annotations to be applied to the Report Generator Pods
+  podAnnotations: {}
+  service:
+    ## @param reports.service.type Type of Service to create for the Report Generator Deployment
+    type: ClusterIP
+    ## @param reports.service.httpPort Port number to expose on the Service for the Report Generator Deployment
+    httpPort: 10001
+  ## @param reports.reportsSecretName Name of the secret containing the report generator access keys. This secret must contain a REPORTS_PASS secret which is the secret credential for the report generators. It must not be updated across chart upgrades, or else the connection between Cryostat and report generators will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  reportsSecretName: ""
+  debug:
+    log:
+      ## @param reports.debug.log.level Log level for troubleshooting and debugging
+      level: INFO
+  ## @param reports.replicas Number of Report Generator replicas to deploy. If zero, the Deployment and Service will not be created and the main Cryostat container will handle all report generations on its own.
+  replicas: 0
+  resources:
+    requests:
+      ## @param reports.resources.requests.cpu CPU resource request for each Pod in the Report Generator Deployment.
+      cpu: 500m
+      ## @param reports.resources.requests.memory Memory resource request for each Pod in the Report Generator Deployment.
+      memory: 512Mi
+  ## @param reports.securityContext [object] Security Context for the Report Generator containers. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip reports.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip reports.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param reports.nodeSelector [object] Node Selector for the Report Generator Pods. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param reports.tolerations [array] Tolerations for the Report Generator Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param reports.affinity [object] Affinity for the Report Generator Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Database Container
+## @extra db Configuration for Cryostat's database
+db:
+  image:
+    ## @param db.image.repository Repository for the database container image
+    repository: "registry.redhat.io/cryostat/cryostat-db-rhel9"
+    ## @param db.image.pullPolicy Image pull policy for the database container image
+    pullPolicy: IfNotPresent
+    ## @param db.image.tag Tag for the database container image
+    tag: "4.0.2"
+  ## @param db.podAnnotations [object] Annotations to be applied to the Database Pods
+  podAnnotations: {}
+  service:
+    ## @param db.service.type Type of Service to create for the database
+    type: ClusterIP
+    ## @param db.service.port Port number to expose on the Service
+    port: 5432
+  resources:
+    requests:
+      ## @param db.resources.requests.cpu CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 25m
+      ## @param db.resources.requests.memory Memory resource request for the database container.
+      memory: 64Mi
+  pvc:
+    ## @param db.pvc.enabled Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.
+    enabled: false
+    ## @param db.pvc.annotations [object] Annotations to add to the persistentVolumeClaim
+    annotations: {}
+    ## @param db.pvc.storage Storage size to request for the persistentVolumeClaim
+    storage: 500Mi
+    ## @param db.pvc.accessModes Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    accessModes:
+      - ReadWriteOnce
+    ## @param db.pvc.selector [object] Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    selector: {}
+    ## @param db.pvc.storageClassName [string, nullable] The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    # storageClassName: ""
+  ## @param db.securityContext [object] Security Context for the database container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip db.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip db.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param db.nodeSelector [object] Node Selector for the Database Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param db.tolerations [array] Tolerations for the Database Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param db.affinity [object] Affinity for the Database Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Storage Container
+## @extra storage Configuration for Cryostat's object storage provider
+storage:
+  ## @param storage.storageSecretName Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  storageSecretName: ""
+  image:
+    ## @param storage.image.repository Repository for the storage container image
+    repository: "registry.redhat.io/cryostat/cryostat-storage-rhel9"
+    ## @param storage.image.pullPolicy Image pull policy for the storage container image
+    pullPolicy: IfNotPresent
+    ## @param storage.image.tag Tag for the storage container image
+    tag: "4.0.2"
+  encryption:
+    ## @param storage.encryption.enabled Enable at-rest encryption of stored objects. The storage container will generate a secret key for each stored object and use this key to encrypt and decrypt objects transparently. The key is written to the object metadata, so in the default storage container configuration this only adds a small layer of additional security.
+    enabled: true
+  ## @param storage.podAnnotations [object] Annotations to be applied to the Storage Pods
+  podAnnotations: {}
+  service:
+    ## @param storage.service.type Type of Service to create for the object storage
+    type: ClusterIP
+    ## @param storage.service.port Port number to expose on the Service
+    port: 8333
+  resources:
+    requests:
+      ## @param storage.resources.requests.cpu CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 50m
+      ## @param storage.resources.requests.memory Memory resource request for the object storage container.
+      memory: 256Mi
+  pvc:
+    ## @param storage.pvc.enabled Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.
+    enabled: false
+    ## @param storage.pvc.annotations [object] Annotations to add to the persistentVolumeClaim
+    annotations: {}
+    ## @param storage.pvc.storage Storage size to request for the persistentVolumeClaim
+    storage: 500Mi
+    ## @param storage.pvc.accessModes Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    accessModes:
+      - ReadWriteOnce
+    ## @param storage.pvc.selector [object] Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    selector: {}
+    ## @param storage.pvc.storageClassName [string, nullable] The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    # storageClassName: ""
+  ## @param storage.securityContext [object] Security Context for the storage container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip storage.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip storage.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param storage.nodeSelector [object] Node Selector for the Storage Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param storage.tolerations [array] Tolerations for the Storage Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param storage.affinity [object] Affinity for the Storage Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Grafana Container
+## @extra grafana Configuration for the customized Grafana instance for Cryostat
+grafana:
+  image:
+    ## @param grafana.image.repository Repository for the Grafana container image
+    repository: "registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9"
+    ## @param grafana.image.pullPolicy Image pull policy for the Grafana container image
+    pullPolicy: IfNotPresent
+    ## @param grafana.image.tag Tag for the Grafana container image
+    tag: "4.0.2"
+  service:
+    ## @param grafana.service.type Type of Service to create for Grafana
+    type: ClusterIP
+    ## @param grafana.service.port Port number to expose on the Service for Grafana's HTTP server
+    port: 3000
+  resources:
+    requests:
+      ## @param grafana.resources.requests.cpu CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 25m
+      ## @param grafana.resources.requests.memory Memory resource request for the Grafana container.
+      memory: 80Mi
+  ## @param grafana.securityContext [object] Security Context for the Grafana container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip grafana.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip grafana.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param grafana.nodeSelector [object] Node Selector for the Grafana Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param grafana.tolerations [array] Tolerations for the Grafana Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+
+## @section JFR Data Source Container
+## @extra datasource Configuration for the JFR Data Source component, which translates recording events into a format consumable by Grafana
+datasource:
+  image:
+    ## @param datasource.image.repository Repository for the JFR Data Source container image
+    repository: "registry.redhat.io/cryostat/jfr-datasource-rhel9"
+    ## @param datasource.image.pullPolicy Image pull policy for the JFR Data Source container image
+    pullPolicy: IfNotPresent
+    ## @param datasource.image.tag Tag for the JFR Data Source container image
+    tag: "4.0.2"
+  resources:
+    requests:
+      ## @param datasource.resources.requests.cpu CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 200m
+      ## @param datasource.resources.requests.memory Memory resource request for the JFR Data Source container.
+      memory: 200Mi
+  ## @param datasource.securityContext [object] Security Context for the JFR Data Source container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip datasource.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip datasource.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param datasource.nodeSelector [object] Node Selector for the JFR Datasource Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param datasource.tolerations [array] Tolerations for the JFR Datasource Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+
+## @section Authentication
+
+authentication:
+  ## @param authentication.cookieSecretName Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  cookieSecretName: ""
+  openshift:
+    ## @param authentication.openshift.enabled Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.
+    enabled: true
+    clusterRole:
+      ## @param authentication.openshift.clusterRole.name The name of the ClusterRole to bind for the OpenShift OAuth Proxy
+      name: system:auth-delegator
+  basicAuth:
+    ## @param authentication.basicAuth.enabled Whether Cryostat should use basic authentication for users. When false, Cryostat will not perform any form of authentication
+    enabled: false
+    ## @param authentication.basicAuth.secretName Name of the Secret that contains the credentials within Cryostat's namespace **(Required if basicAuth is enabled)**
+    secretName: ""
+    ## @param authentication.basicAuth.filename Key within Secret containing the `htpasswd` file. The file should contain one user definition entry per line, with the syntax "user:passHash", where "user" is the username and "passHash" is the `bcrypt` hash of the desired password. Such an entry can be generated with ex. `htpasswd -nbB username password` **(Required if basicAuth is enabled)**
+    filename: ""
+
+## @section OAuth2 Proxy
+
+oauth2Proxy:
+  image:
+    ## @param oauth2Proxy.image.repository Repository for the OAuth2 Proxy container image
+    repository: ""
+    ## @param oauth2Proxy.image.pullPolicy Image pull policy for the OAuth2 Proxy container image
+    pullPolicy: Never
+    ## @param oauth2Proxy.image.tag Tag for the OAuth2 Proxy container image
+    tag: ""
+  tls:
+    selfSigned:
+      ## @param oauth2Proxy.tls.selfSigned.enabled Whether a self-signed TLS certificate for oauth2-proxy HTTPS is generated and used.
+      enabled: false
+  resources:
+    requests:
+      ## @param oauth2Proxy.resources.requests.cpu CPU resource request for the OAuth2 Proxy container.
+      cpu: 25m
+      ## @param oauth2Proxy.resources.requests.memory Memory resource request for the OAuth2 Proxy container.
+      memory: 64Mi
+  ## @param oauth2Proxy.securityContext [object] Security Context for the OAuth2 Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1).
+  securityContext:
+    ## @skip oauth2Proxy.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip oauth2Proxy.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+
+## @section OpenShift OAuth Proxy
+
+openshiftOauthProxy:
+  image:
+    ## @param openshiftOauthProxy.image.repository Repository for the OpenShift OAuth Proxy container image
+    repository: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+    ## @param openshiftOauthProxy.image.pullPolicy Image pull policy for the OpenShift OAuth Proxy container image
+    pullPolicy: IfNotPresent
+    ## @param openshiftOauthProxy.image.tag Tag for the OpenShift OAuth Proxy container image
+    tag: "4.0.2"
+  resources:
+    requests:
+      ## @param openshiftOauthProxy.resources.requests.cpu CPU resource request for the OpenShift OAuth Proxy container.
+      cpu: 25m
+      ## @param openshiftOauthProxy.resources.requests.memory Memory resource request for the OpenShift OAuth Proxy container.
+      memory: 64Mi
+  accessReview:
+    ## @param openshiftOauthProxy.accessReview.enabled Whether the SubjectAccessReview/TokenAccessReview role checks for users and clients are enabled. If this is disabled then the proxy will only check that the user has valid credentials or holds a valid token.
+    enabled: true
+    ## @param openshiftOauthProxy.accessReview.group The OpenShift resource group that the SubjectAccessReview/TokenAccessReview will be performed for. See https://github.com/openshift/oauth-proxy/?tab=readme-ov-file#delegate-authentication-and-authorization-to-openshift-for-infrastructure
+    group: ""
+    ## @param openshiftOauthProxy.accessReview.resource The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.
+    resource: "pods"
+    ## @param openshiftOauthProxy.accessReview.subresource The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.
+    subresource: "exec"
+    ## @param openshiftOauthProxy.accessReview.name The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.
+    name: ""
+    ## @param openshiftOauthProxy.accessReview.namespace The OpenShift namespace that the SubjectAccessReview/TokenAccessReview will be performed for.
+    namespace: "{{ .Release.Namespace }}"
+    ## @param openshiftOauthProxy.accessReview.verb The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.
+    verb: "create"
+    ## @param openshiftOauthProxy.accessReview.version The OpenShift resource version that the SubjectAccessReview/TokenAccessReview will be performed for.
+    version: ""
+  ## @param openshiftOauthProxy.securityContext [object] Security Context for the OpenShift OAuth Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip openshiftOauthProxy.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip openshiftOauthProxy.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+
+## @section Other Parameters
+
+## @param imagePullSecrets [array] Image pull secrets to be used for the Cryostat deployment
+imagePullSecrets: []
+## @param nameOverride Overrides the name of this Chart
+nameOverride: ""
+## @param fullnameOverride Overrides the fully qualified application name of `[release name]-[chart name]`
+fullnameOverride: ""
+
+rbac:
+  ## @param rbac.create Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  ## @param serviceAccount.create Specifies whether a service account should be created
+  create: true
+  ## @param serviceAccount.annotations [object] Annotations to add to the service account
+  annotations: {}
+  ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+## @param podAnnotations [object] Annotations to be applied to the various Pods
+podAnnotations: {}
+
+## @param podSecurityContext [object] Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context)
+podSecurityContext:
+  ## @skip podSecurityContext.runAsNonRoot
+  runAsNonRoot: true
+  ## @skip podSecurityContext.seccompProfile
+  seccompProfile:
+    type: RuntimeDefault
+
+networkPolicy:
+  ingress:
+    ## @param networkPolicy.ingress.enabled whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.
+    enabled: true
+
+## @param nodeSelector [object] default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+nodeSelector: {}
+
+## @param tolerations [array] default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+tolerations: []
+
+## @param affinity [object] default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+affinity: {}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/.helmignore b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/.helmignore
new file mode 100644
index 000000000..0e8a0eb36
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/Chart.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/Chart.yaml
new file mode 100644
index 000000000..038c4bc34
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/Chart.yaml
@@ -0,0 +1,46 @@
+apiVersion: v2
+name: redhat-cryostat
+description: Securely manage JFR recordings for your containerized Java workloads
+
+type: application
+
+version: "2.0.3"
+
+kubeVersion: ">= 1.25.0-0"
+
+appVersion: "4.0.3-redhat"
+
+home: "https://cryostat.io"
+
+icon: "https://raw.githubusercontent.com/cryostatio/cryostat-helm/main/docs/images/cryostat-icon.svg"
+
+annotations:
+  charts.openshift.io/archs: x86_64, aarch64
+  charts.openshift.io/name: Red Hat build of Cryostat
+  charts.openshift.io/provider: Red Hat
+  charts.openshift.io/supportURL: https://github.com/cryostatio/cryostat-helm
+
+keywords:
+- flightrecorder
+- java
+- jdk
+- jfr
+- jmc
+- missioncontrol
+- monitoring
+- profiling
+- diagnostic
+
+sources:
+- https://github.com/cryostatio/cryostat
+- https://github.com/cryostatio/cryostat-core
+- https://github.com/cryostatio/cryostat-web
+- https://github.com/cryostatio/jfr-datasource
+- https://github.com/cryostatio/cryostat-grafana-dashboard
+- https://github.com/cryostatio/cryostat-db
+- https://github.com/cryostatio/cryostat-storage
+- https://github.com/cryostatio/openshift-oauth-proxy
+
+maintainers:
+- name: The Cryostat Community
+  url: https://groups.google.com/g/cryostat-development
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/LICENSE b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/LICENSE
new file mode 100644
index 000000000..57bc88a15
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/LICENSE
@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/README.md b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/README.md
new file mode 100644
index 000000000..ada5b0b31
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/README.md
@@ -0,0 +1,274 @@
+# Cryostat Helm Chart
+
+![Version: 2.0.0-dev](https://img.shields.io/badge/Version-2.0.0--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 4.0.0-dev](https://img.shields.io/badge/AppVersion-4.0.0--dev-informational?style=flat-square)
+
+A Helm chart for deploying [Cryostat](https://cryostat.io/) on Kubernetes and OpenShift.
+
+## Requirements
+
+Kubernetes: `>= 1.25.0-0`
+
+## Installation
+
+### From Helm repository
+
+The chart is available at the following repositories:
+
+- https://cryostat.io/helm-charts
+- https://charts.openshift.io
+
+To install the chart, add the repository and install, for example:
+
+```bash
+helm repo add cryostat-charts https://cryostat.io/helm-charts
+helm repo update
+helm install cryostat cryostat-charts/cryostat
+```
+
+### From OCI container registry
+
+The chart is also available as an OCI image on GitHub Container Registry (`ghcr.io`).
+
+To install the chart, run:
+
+```bash
+helm install cryostat oci://ghcr.io/cryostatio/cryostat-helm --version $VERSION
+```
+
+### From source code
+
+To install the chart from source code, run:
+
+```bash
+git clone https://github.com/cryostatio/cryostat-helm
+cd cryostat-helm
+helm install cryostat ./charts/cryostat
+```
+
+## Configuration
+
+See the sections below for Helm chart values which can be used for configuring various aspects of the Cryostat installation.
+
+If there are further customizations required to suit your deployment environment, choose the settings values that get
+you closest to what you need, then manually edit the resulting Kubernetes objects to suit your requirements. You may
+also consider using `helm install --dry-run` to render the Kubernetes YAML manifests without installing them, so that
+you can apply your own customization patches as needed.
+
+### TLS
+
+When installed on OpenShift with `authentication.openshift.enabled=true`, the cluster's
+["service serving certificates"](https://docs.openshift.com/container-platform/4.17/security/certificates/service-serving-certificate.html)
+feature is used to enable managed TLS configuration on the exposed HTTP(S) ports.
+
+When installed with `authentication.openshift.enabled=false` but `oauth2Proxy.tls.selfSigned.enabled=true` then a
+self-signed TLS certificate will be generated at installation time to serve similar purposes. These TLS certificates
+are not managed, will not automatically rotate, and will expire after 365 days. You will need to manually rotate the
+certificates, or reinstall the chart, or else apply your own customizations to the Kubernetes manifests to automate TLS
+certificate issuance and rotation.
+
+## Parameters
+
+### Cryostat Container
+
+| Name                                                   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Value                                        |
+| ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
+| `core`                                                 | Configuration for the core Cryostat application                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                              |
+| `core.image.repository`                                | Repository for the main Cryostat container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `registry.redhat.io/cryostat/cryostat-rhel9` |
+| `core.image.pullPolicy`                                | Image pull policy for the main Cryostat container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `IfNotPresent`                               |
+| `core.image.tag`                                       | Tag for the main Cryostat container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `4.0.3`                                      |
+| `core.podAnnotations`                                  | Annotations to be applied to the Cryostat Pods                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                         |
+| `core.service.type`                                    | Type of Service to create for the Cryostat application                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `ClusterIP`                                  |
+| `core.service.httpPort`                                | Port number to expose on the Service for Cryostat's HTTP server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `8181`                                       |
+| `core.debug.log.level`                                 | Log level for troubleshooting and debugging                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `INFO`                                       |
+| `core.sslProxied`                                      | Enables SSL Proxied Environment Variables, useful when you are offloading SSL/TLS at External Loadbalancer instead of Ingress                                                                                                                                                                                                                                                                                                                                                                                                                  | `false`                                      |
+| `core.ingress.enabled`                                 | Whether to create an Ingress object for the Cryostat service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                                      |
+| `core.ingress.className`                               | Ingress class name for the Cryostat application Ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `""`                                         |
+| `core.ingress.annotations`                             | Annotations to apply to the Cryostat application Ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `{}`                                         |
+| `core.ingress.hosts`                                   | Hosts to create rules for in the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)                                                                                                                                                                                                                                                                                                                                                               | `[]`                                         |
+| `core.ingress.tls`                                     | TLS configuration for the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)                                                                                                                                                                                                                                                                                                                                                                      | `[]`                                         |
+| `core.route.enabled`                                   | Whether to create a Route object for the Cryostat service. Available only on OpenShift                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `true`                                       |
+| `core.route.tls.enabled`                               | Whether to secure the Cryostat application Route with TLS. See: [TLSConfig](https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/route-route-openshift-io-v1.html#spec-tls)                                                                                                                                                                                                                                                                                                                                                | `true`                                       |
+| `core.route.tls.termination`                           | Type of TLS termination to use for the Cryostat application Route. One of: `edge`, `passthrough`, `reencrypt`                                                                                                                                                                                                                                                                                                                                                                                                                                  | `edge`                                       |
+| `core.route.tls.insecureEdgeTerminationPolicy`         | Specify how to handle insecure traffic for the Cryostat application Route. One of: `Allow`, `Disable`, `Redirect`                                                                                                                                                                                                                                                                                                                                                                                                                              | `Redirect`                                   |
+| `core.route.tls.key`                                   | Custom private key to use when securing the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `""`                                         |
+| `core.route.tls.certificate`                           | Custom certificate to use when securing the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `""`                                         |
+| `core.route.tls.caCertificate`                         | Custom CA certificate to use, if needed to complete the certificate chain, when securing the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                                        | `""`                                         |
+| `core.route.tls.destinationCACertificate`              | Provides the contents of the CA certificate of the final destination when using reencrypt termination for the Cryostat application Route                                                                                                                                                                                                                                                                                                                                                                                                       | `""`                                         |
+| `core.resources.requests.cpu`                          | CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                                                                                                                                                                                                                                                         | `500m`                                       |
+| `core.resources.requests.memory`                       | Memory resource request for the Cryostat container.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `384Mi`                                      |
+| `core.securityContext`                                 | Security Context for the Cryostat container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)                                                                                                                                                                                                                                 | `{}`                                         |
+| `core.databaseSecretName`                              | Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data stored within the database, such as the target credentials keyring. It must not be updated across chart upgrades. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                                         |
+| `core.discovery`                                       | Configuration options to the Cryostat application's target discovery mechanisms                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                              |
+| `core.discovery.kubernetes.enabled`                    | Enables Kubernetes API discovery mechanism                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `true`                                       |
+| `core.discovery.kubernetes.installNamespaceDisabled`   | When false and `namespaces` is empty, the Cryostat application will default to discovery targets in the install namespace (i.e. `{{ .Release.Namespace }}`)                                                                                                                                                                                                                                                                                                                                                                                    | `false`                                      |
+| `core.discovery.kubernetes.namespaces`                 | List of namespaces whose workloads the Cryostat application should be permitted to access and profile                                                                                                                                                                                                                                                                                                                                                                                                                                          | `[]`                                         |
+| `core.discovery.kubernetes.builtInPortNamesDisabled`   | When false and `portNames` is empty, the Cryostat application will use the default port name `jfr-jmx` to look for JMX connectable targets.                                                                                                                                                                                                                                                                                                                                                                                                    | `false`                                      |
+| `core.discovery.kubernetes.portNames`                  | List of port names that the Cryostat application should look for in order to consider a target as JMX connectable                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                                         |
+| `core.discovery.kubernetes.builtInPortNumbersDisabled` | When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                                      |
+| `core.discovery.kubernetes.portNumbers`                | List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable                                                                                                                                                                                                                                                                                                                                                                                                                            | `[]`                                         |
+| `core.config.eventTemplates.configMapNames`            | List of ConfigMap names. Each ConfigMap is expected to contain one or more files, which are .jfc (XML) JFR Event Templates, to be mounted to the Cryostat container.                                                                                                                                                                                                                                                                                                                                                                           | `[]`                                         |
+| `core.config.tlsTruststore.secretNames`                | List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.                                                                                                                                                                                                                                                                                                                | `[]`                                         |
+| `core.nodeSelector`                                    | Node Selector for the Cryostat Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                             | `{}`                                         |
+| `core.tolerations`                                     | Tolerations for the Cryostat Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                                | `[]`                                         |
+| `core.affinity`                                        | Affinity for the Cryostat Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                         |
+
+### Report Generator Deployment
+
+| Name                                | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Value                                                |
+| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| `reports`                           | Configuration for the Reports Generator deployment                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                      |
+| `reports.image.repository`          | Repository for the Report Generator container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `registry.redhat.io/cryostat/cryostat-reports-rhel9` |
+| `reports.image.pullPolicy`          | Image pull policy for the Report Generator container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `IfNotPresent`                                       |
+| `reports.image.tag`                 | Tag for the Report Generator image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `4.0.3`                                              |
+| `reports.podAnnotations`            | Annotations to be applied to the Report Generator Pods                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                 |
+| `reports.service.type`              | Type of Service to create for the Report Generator Deployment                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `ClusterIP`                                          |
+| `reports.service.httpPort`          | Port number to expose on the Service for the Report Generator Deployment                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `10001`                                              |
+| `reports.reportsSecretName`         | Name of the secret containing the report generator access keys. This secret must contain a REPORTS_PASS secret which is the secret credential for the report generators. It must not be updated across chart upgrades, or else the connection between Cryostat and report generators will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                                                 |
+| `reports.debug.log.level`           | Log level for troubleshooting and debugging                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `INFO`                                               |
+| `reports.replicas`                  | Number of Report Generator replicas to deploy. If zero, the Deployment and Service will not be created and the main Cryostat container will handle all report generations on its own.                                                                                                                                                                                                                                                                                                                                       | `0`                                                  |
+| `reports.resources.requests.cpu`    | CPU resource request for each Pod in the Report Generator Deployment.                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `500m`                                               |
+| `reports.resources.requests.memory` | Memory resource request for each Pod in the Report Generator Deployment.                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `512Mi`                                              |
+| `reports.securityContext`           | Security Context for the Report Generator containers. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)                                                                                                                                                                                                     | `{}`                                                 |
+| `reports.nodeSelector`              | Node Selector for the Report Generator Pods. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                 | `{}`                                                 |
+| `reports.tolerations`               | Tolerations for the Report Generator Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                    | `[]`                                                 |
+| `reports.affinity`                  | Affinity for the Report Generator Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                          | `{}`                                                 |
+
+### Database Container
+
+| Name                           | Description                                                                                                                                                                                                                                                                                                    | Value                                           |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
+| `db`                           | Configuration for Cryostat's database                                                                                                                                                                                                                                                                          |                                                 |
+| `db.image.repository`          | Repository for the database container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/cryostat-db-rhel9` |
+| `db.image.pullPolicy`          | Image pull policy for the database container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                  |
+| `db.image.tag`                 | Tag for the database container image                                                                                                                                                                                                                                                                           | `4.0.3`                                         |
+| `db.podAnnotations`            | Annotations to be applied to the Database Pods                                                                                                                                                                                                                                                                 | `{}`                                            |
+| `db.service.type`              | Type of Service to create for the database                                                                                                                                                                                                                                                                     | `ClusterIP`                                     |
+| `db.service.port`              | Port number to expose on the Service                                                                                                                                                                                                                                                                           | `5432`                                          |
+| `db.resources.requests.cpu`    | CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                         | `25m`                                           |
+| `db.resources.requests.memory` | Memory resource request for the database container.                                                                                                                                                                                                                                                            | `64Mi`                                          |
+| `db.pvc.enabled`               | Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.                                                                                                                        | `false`                                         |
+| `db.pvc.annotations`           | Annotations to add to the persistentVolumeClaim                                                                                                                                                                                                                                                                | `{}`                                            |
+| `db.pvc.storage`               | Storage size to request for the persistentVolumeClaim                                                                                                                                                                                                                                                          | `500Mi`                                         |
+| `db.pvc.accessModes`           | Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                         | `["ReadWriteOnce"]`                             |
+| `db.pvc.selector`              | Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                | `{}`                                            |
+| `db.pvc.storageClassName`      | The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                               | `undefined`                                     |
+| `db.securityContext`           | Security Context for the database container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                            |
+| `db.nodeSelector`              | Node Selector for the Database Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                             | `{}`                                            |
+| `db.tolerations`               | Tolerations for the Database Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                | `[]`                                            |
+| `db.affinity`                  | Affinity for the Database Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                      | `{}`                                            |
+
+### Storage Container
+
+| Name                                | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Value                                                |
+| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| `storage`                           | Configuration for Cryostat's object storage provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                      |
+| `storage.storageSecretName`         | Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                                                 |
+| `storage.image.repository`          | Repository for the storage container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `registry.redhat.io/cryostat/cryostat-storage-rhel9` |
+| `storage.image.pullPolicy`          | Image pull policy for the storage container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `IfNotPresent`                                       |
+| `storage.image.tag`                 | Tag for the storage container image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `4.0.3`                                              |
+| `storage.encryption.enabled`        | Enable at-rest encryption of stored objects. The storage container will generate a secret key for each stored object and use this key to encrypt and decrypt objects transparently. The key is written to the object metadata, so in the default storage container configuration this only adds a small layer of additional security.                                                                                                                                                                                              | `true`                                               |
+| `storage.podAnnotations`            | Annotations to be applied to the Storage Pods                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `{}`                                                 |
+| `storage.service.type`              | Type of Service to create for the object storage                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `ClusterIP`                                          |
+| `storage.service.port`              | Port number to expose on the Service                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `8333`                                               |
+| `storage.resources.requests.cpu`    | CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                                                                                                                                                                                                                                       | `50m`                                                |
+| `storage.resources.requests.memory` | Memory resource request for the object storage container.                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `256Mi`                                              |
+| `storage.pvc.enabled`               | Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.                                                                                                                                                                                                                                                                                                                                            | `false`                                              |
+| `storage.pvc.annotations`           | Annotations to add to the persistentVolumeClaim                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `{}`                                                 |
+| `storage.pvc.storage`               | Storage size to request for the persistentVolumeClaim                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `500Mi`                                              |
+| `storage.pvc.accessModes`           | Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                                                                                                                                                                                                                             | `["ReadWriteOnce"]`                                  |
+| `storage.pvc.selector`              | Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                                                                                                                                                                                                                                    | `{}`                                                 |
+| `storage.pvc.storageClassName`      | The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)                                                                                                                                                                                                                                                                                                                                                                   | `undefined`                                          |
+| `storage.securityContext`           | Security Context for the storage container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)                                                                                                                                                                                                                      | `{}`                                                 |
+| `storage.nodeSelector`              | Node Selector for the Storage Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                  | `{}`                                                 |
+| `storage.tolerations`               | Tolerations for the Storage Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                     | `[]`                                                 |
+| `storage.affinity`                  | Affinity for the Storage Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                                                                                                                                                                                                                                           | `{}`                                                 |
+
+### Grafana Container
+
+| Name                                | Description                                                                                                                                                                                                                                                                                                   | Value                                                          |
+| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `grafana`                           | Configuration for the customized Grafana instance for Cryostat                                                                                                                                                                                                                                                |                                                                |
+| `grafana.image.repository`          | Repository for the Grafana container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9` |
+| `grafana.image.pullPolicy`          | Image pull policy for the Grafana container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                                 |
+| `grafana.image.tag`                 | Tag for the Grafana container image                                                                                                                                                                                                                                                                           | `4.0.3`                                                        |
+| `grafana.service.type`              | Type of Service to create for Grafana                                                                                                                                                                                                                                                                         | `ClusterIP`                                                    |
+| `grafana.service.port`              | Port number to expose on the Service for Grafana's HTTP server                                                                                                                                                                                                                                                | `3000`                                                         |
+| `grafana.resources.requests.cpu`    | CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                         | `25m`                                                          |
+| `grafana.resources.requests.memory` | Memory resource request for the Grafana container.                                                                                                                                                                                                                                                            | `80Mi`                                                         |
+| `grafana.securityContext`           | Security Context for the Grafana container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                                           |
+| `grafana.nodeSelector`              | Node Selector for the Grafana Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                             | `{}`                                                           |
+| `grafana.tolerations`               | Tolerations for the Grafana Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                | `[]`                                                           |
+
+### JFR Data Source Container
+
+| Name                                   | Description                                                                                                                                                                                                                                                                                                           | Value                                              |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| `datasource`                           | Configuration for the JFR Data Source component, which translates recording events into a format consumable by Grafana                                                                                                                                                                                                |                                                    |
+| `datasource.image.repository`          | Repository for the JFR Data Source container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/jfr-datasource-rhel9` |
+| `datasource.image.pullPolicy`          | Image pull policy for the JFR Data Source container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                     |
+| `datasource.image.tag`                 | Tag for the JFR Data Source container image                                                                                                                                                                                                                                                                           | `4.0.3`                                            |
+| `datasource.resources.requests.cpu`    | CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)                                                                                                                                         | `200m`                                             |
+| `datasource.resources.requests.memory` | Memory resource request for the JFR Data Source container.                                                                                                                                                                                                                                                            | `200Mi`                                            |
+| `datasource.securityContext`           | Security Context for the JFR Data Source container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                               |
+| `datasource.nodeSelector`              | Node Selector for the JFR Datasource Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                              | `{}`                                               |
+| `datasource.tolerations`               | Tolerations for the JFR Datasource Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                                 | `[]`                                               |
+
+### Authentication
+
+| Name                                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Value                   |
+| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
+| `authentication.cookieSecretName`           | Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable | `""`                    |
+| `authentication.openshift.enabled`          | Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.                                                                                                                                                                                                                                                                                                                                  | `true`                  |
+| `authentication.openshift.clusterRole.name` | The name of the ClusterRole to bind for the OpenShift OAuth Proxy                                                                                                                                                                                                                                                                                                                                                                                                                | `system:auth-delegator` |
+| `authentication.basicAuth.enabled`          | Whether Cryostat should use basic authentication for users. When false, Cryostat will not perform any form of authentication                                                                                                                                                                                                                                                                                                                                                     | `false`                 |
+| `authentication.basicAuth.secretName`       | Name of the Secret that contains the credentials within Cryostat's namespace **(Required if basicAuth is enabled)**                                                                                                                                                                                                                                                                                                                                                              | `""`                    |
+| `authentication.basicAuth.filename`         | Key within Secret containing the `htpasswd` file. The file should contain one user definition entry per line, with the syntax "user:passHash", where "user" is the username and "passHash" is the `bcrypt` hash of the desired password. Such an entry can be generated with ex. `htpasswd -nbB username password` **(Required if basicAuth is enabled)**                                                                                                                        | `""`                    |
+
+### OAuth2 Proxy
+
+| Name                                    | Description                                                                                                                                                                                                                                                                                                         | Value   |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `oauth2Proxy.image.repository`          | Repository for the OAuth2 Proxy container image                                                                                                                                                                                                                                                                     | `""`    |
+| `oauth2Proxy.image.pullPolicy`          | Image pull policy for the OAuth2 Proxy container image                                                                                                                                                                                                                                                              | `Never` |
+| `oauth2Proxy.image.tag`                 | Tag for the OAuth2 Proxy container image                                                                                                                                                                                                                                                                            | `""`    |
+| `oauth2Proxy.tls.selfSigned.enabled`    | Whether a self-signed TLS certificate for oauth2-proxy HTTPS is generated and used.                                                                                                                                                                                                                                 | `false` |
+| `oauth2Proxy.resources.requests.cpu`    | CPU resource request for the OAuth2 Proxy container.                                                                                                                                                                                                                                                                | `25m`   |
+| `oauth2Proxy.resources.requests.memory` | Memory resource request for the OAuth2 Proxy container.                                                                                                                                                                                                                                                             | `64Mi`  |
+| `oauth2Proxy.securityContext`           | Security Context for the OAuth2 Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1). | `{}`    |
+
+### OpenShift OAuth Proxy
+
+| Name                                            | Description                                                                                                                                                                                                                                                                                                                 | Value                                                        |
+| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| `openshiftOauthProxy.image.repository`          | Repository for the OpenShift OAuth Proxy container image                                                                                                                                                                                                                                                                    | `registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9` |
+| `openshiftOauthProxy.image.pullPolicy`          | Image pull policy for the OpenShift OAuth Proxy container image                                                                                                                                                                                                                                                             | `IfNotPresent`                                               |
+| `openshiftOauthProxy.image.tag`                 | Tag for the OpenShift OAuth Proxy container image                                                                                                                                                                                                                                                                           | `4.0.3`                                                      |
+| `openshiftOauthProxy.resources.requests.cpu`    | CPU resource request for the OpenShift OAuth Proxy container.                                                                                                                                                                                                                                                               | `25m`                                                        |
+| `openshiftOauthProxy.resources.requests.memory` | Memory resource request for the OpenShift OAuth Proxy container.                                                                                                                                                                                                                                                            | `64Mi`                                                       |
+| `openshiftOauthProxy.accessReview.enabled`      | Whether the SubjectAccessReview/TokenAccessReview role checks for users and clients are enabled. If this is disabled then the proxy will only check that the user has valid credentials or holds a valid token.                                                                                                             | `true`                                                       |
+| `openshiftOauthProxy.accessReview.group`        | The OpenShift resource group that the SubjectAccessReview/TokenAccessReview will be performed for. See https://github.com/openshift/oauth-proxy/?tab=readme-ov-file#delegate-authentication-and-authorization-to-openshift-for-infrastructure                                                                               | `""`                                                         |
+| `openshiftOauthProxy.accessReview.resource`     | The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                                | `pods`                                                       |
+| `openshiftOauthProxy.accessReview.subresource`  | The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                                | `exec`                                                       |
+| `openshiftOauthProxy.accessReview.name`         | The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                           | `""`                                                         |
+| `openshiftOauthProxy.accessReview.namespace`    | The OpenShift namespace that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                               | `{{ .Release.Namespace }}`                                   |
+| `openshiftOauthProxy.accessReview.verb`         | The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                           | `create`                                                     |
+| `openshiftOauthProxy.accessReview.version`      | The OpenShift resource version that the SubjectAccessReview/TokenAccessReview will be performed for.                                                                                                                                                                                                                        | `""`                                                         |
+| `openshiftOauthProxy.securityContext`           | Security Context for the OpenShift OAuth Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}`                                                         |
+
+### Other Parameters
+
+| Name                            | Description                                                                                                                                                                                                                                                                                               | Value  |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
+| `imagePullSecrets`              | Image pull secrets to be used for the Cryostat deployment                                                                                                                                                                                                                                                 | `[]`   |
+| `nameOverride`                  | Overrides the name of this Chart                                                                                                                                                                                                                                                                          | `""`   |
+| `fullnameOverride`              | Overrides the fully qualified application name of `[release name]-[chart name]`                                                                                                                                                                                                                           | `""`   |
+| `rbac.create`                   | Specifies whether RBAC resources should be created                                                                                                                                                                                                                                                        | `true` |
+| `serviceAccount.create`         | Specifies whether a service account should be created                                                                                                                                                                                                                                                     | `true` |
+| `serviceAccount.annotations`    | Annotations to add to the service account                                                                                                                                                                                                                                                                 | `{}`   |
+| `serviceAccount.name`           | The name of the service account to use. If not set and create is true, a name is generated using the fullname template                                                                                                                                                                                    | `""`   |
+| `podAnnotations`                | Annotations to be applied to the various Pods                                                                                                                                                                                                                                                             | `{}`   |
+| `podSecurityContext`            | Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}`   |
+| `networkPolicy.ingress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.                                  | `true` |
+| `nodeSelector`                  | default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                           | `{}`   |
+| `tolerations`                   | default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                   | `[]`   |
+| `affinity`                      | default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)                                                                                                                                                         | `{}`   |
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/TESTING.md b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/TESTING.md
new file mode 100644
index 000000000..ff9fb3beb
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/TESTING.md
@@ -0,0 +1,148 @@
+# Testing Guide for Cryostat Helm Chart
+
+This guide outlines the conventions and practices for writing and executing tests in the Cryostat Helm chart project using the Helm Unittest plugin.
+
+## Overview
+
+Helm Unittest is a Helm plugin that allows to write declarative tests for Helm charts. It enables testing the rendered templates of a Helm chart with specified values without the need for any running Kubernetes cluster.
+
+# Testing Guide for Cryostat Helm Chart
+
+## Requirements
+
+Before running tests, you need to have the following tools installed:
+
+- **Helm:** Helm is a package manager for Kubernetes needed to manage the charts.
+  `Required version: >= v3.14.4`
+- **Helm Unittest Plugin:** This plugin enables unit testing for Helm charts.
+  `Required version: >= v0.5.1`
+
+## Installation
+
+##### Installing Helm
+
+Helm can be installed on a variety of platforms. [Official Helm installation documentation](https://helm.sh/docs/intro/install/) provides detailed instructions.
+
+##### Installing Helm Unittest Plugin
+
+Once Helm is installed, you can install the Helm Unittest plugin.
+First, verify whether the Helm Unittest plugin has been successfully installed, you can use the following command to list all installed Helm plugins:
+```bash
+helm plugin list
+```
+This command will display a list of all plugins currently installed in your Helm environment, including the Helm Unittest plugin if it's already installed. Look for an entry named unittest in the output. If it's listed, then the Helm Unittest plugin is installed correctly. For example:
+```
+❯ helm plugin list
+
+NAME    	VERSION	DESCRIPTION
+unittest	0.5.1  	Unit test for helm chart in YAML with ease
+to keep your chart functional and robust.
+```
+If the Helm Unittest plugin is not listed, you can install it using the following command:
+```bash
+$ helm plugin install https://github.com/helm-unittest/helm-unittest.git
+```
+This will install the latest version of binary into helm plugin directory.
+
+## Writing Tests
+
+Each test is associated with a specific Helm template and is structured to validate specific aspects of that template. Here's a general structure for writing tests:
+
+1. **Test Suite:** A collection of tests related to a particular aspect of the chart, usually corresponding to a specific template file.
+2. **Test Cases:** Each test case should focus on a single aspect or feature of the chart. Test cases can have different configurations set through the `set` directive to simulate different environments or scenarios.
+3. **Assertions:** Test cases contain assertions that specify the expected output of the rendered templates. Assertions can check for the existence of objects, equality of values, matching patterns, and more.
+
+##### Naming Conventions for Test Files
+The naming convention for test files typically mirrors the name of the template they are testing with a `_test` suffix. For example:
+
+- service.yaml ➔ service_test.yaml
+- deployment.yaml ➔ deployment_test.yaml
+
+## Directory Structure
+
+Tests are organized under the `tests/` directory, with each test file corresponding to a template in the `templates/` directory:
+
+```plaintext
+cryostat-helm/
+├── charts
+│   └── cryostat
+│       ├── Chart.yaml
+│       ├── templates
+│       │   ├── alpha_config.yaml
+│       │   ├── ...
+│       │   └── tests
+│       │       ├── test-core-connection.yaml
+│       │       └── ...
+│       ├── TESTING.md
+│       ├── tests
+│       │   ├── alpha_config_test.yaml
+│       │   ├── ...
+│       │   ├── __snapshot__
+│       │   └── storage_access_secret_test.yaml
+│       ├── values.schema.json
+│       └── values.yaml
+
+```
+In addition, Cryostat Helm chart includes integration tests located in the `templates/tests` directory and are executed using `helm test`. These tests are different from unit tests in that they involve actual deployment of resources to a Kubernetes cluster to validate the integrated operation of those resources.
+
+## Test File Structure
+
+Here's an example of what a test file looks like:
+
+```yaml
+suite: <Name of Test Suite>
+templates:
+  - <path to template from chart root>
+tests:
+  - it: <description of what the test does>
+    set:
+      <values to be set>
+    asserts:
+      - <assert type>:
+          path: <path to value to test>
+          value: <expected value>
+```
+## Common Assertions
+- `equal`: Checks if the actual value at path equals the expected value.
+- `matchRegex`: Validates if the actual string matches the given regex pattern.
+- `exists`: Checks if the specified path exists in the document.
+- `notExists`: Ensures the specified path does not exist in the document.
+
+Visit [this document](https://github.com/helm-unittest/helm-unittest/blob/main/DOCUMENT.md#assertion-types) for more assertion types.
+## Running Tests
+
+Once Unittest plugin has been installed, tests can be executed by running the following command:
+```bash
+$ helm unittest <path-to-chart-directory>
+```
+In the case of `cryostat-helm`, the command would be:
+
+```bash
+$ helm unittest ./charts/cryostat
+```
+To run test for a specific test file, use the `-f` flag with helm unittest to specify the test file to be executed. Here's the command format:
+
+```bash
+$ helm unittest -f tests/<testfile>.yaml ./charts/<chartname>
+```
+This command will run the test for `service_test.yaml` file:
+
+```bash
+$ helm unittest -f tests/service_test.yaml ./charts/cryostat
+```
+## Additional Resources and Documentation
+
+For more infomation on Helm and writing tests for Helm charts, the following resources can be invaluable:
+
+### Helm Documentation
+
+- **Helm Official Documentation:** Provides comprehensive guides, tutorials, and reference material for working with Helm.
+  [Helm Documentation](https://helm.sh/docs/)
+
+- **Helm Chart Best Practices:** A guide by the Helm community outlining best practices for creating and managing Helm charts.
+  [Helm Chart Best Practices](https://helm.sh/docs/chart_best_practices/)
+
+### Helm Unittest Plugin
+
+- **Helm Unittest GitHub Repository:** Contains the source code, installation instructions, and detailed usage examples of the Helm Unittest plugin.
+  [Helm Unittest on GitHub](https://github.com/helm-unittest/helm-unittest)
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/release-notes.md b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/release-notes.md
new file mode 100644
index 000000000..99ccb509e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/release-notes.md
@@ -0,0 +1 @@
+<!-- Release notes generated using configuration in .github/release.yml -->
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/NOTES.txt b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/NOTES.txt
new file mode 100644
index 000000000..595f10117
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/NOTES.txt
@@ -0,0 +1,64 @@
+{{- $envVars := list }}
+{{- $portForwards := false }}
+{{- $listNum := 1 }}
+{{- if not .Values.core.ingress.enabled }}
+{{ $listNum }}. Configure the application to serve external traffic:
+{{- $listNum = add1 $listNum }}
+  ```
+{{- if .Values.core.route.enabled }}
+{{- /* Do nothing */}}
+  No actions required with this configuration.
+{{- else if .Values.core.ingress.enabled }}
+{{- /* Do nothing */}}
+  No actions required with this configuration.
+{{- else if contains "ClusterIP" .Values.core.service.type }}
+  {{- /* Do nothing */}}
+  No actions required with this configuration.
+{{- $portForwards = true }}
+{{- else if contains "NodePort" .Values.core.service.type }}
+  export NODE_IP=$(oc get nodes -n {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(oc get -n {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "cryostat.fullname" . }})
+{{- $envVars = list "QUARKUS_HTTP_HOST=$NODE_IP" }}
+{{- else if contains "LoadBalancer" .Values.core.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status by running 'oc get -n {{ .Release.Namespace }} -w svc/{{ include "cryostat.fullname" . }}'
+  export SERVICE_IP=$(oc get svc -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+{{- $envVars = list "QUARKUS_HTTP_HOST=$SERVICE_IP" }}
+{{- end }}
+
+{{- if not (empty $envVars) }}
+  oc -n {{ .Release.Namespace }} set env deploy --containers={{ .Chart.Name }} {{ include "cryostat.deploymentName" . }} {{ join " " $envVars }}
+{{- end }}
+  ```
+{{- end }}
+
+{{- if $portForwards }}
+
+{{ $listNum }}. Forward local port to the application's service:
+  ```
+  oc -n {{ .Release.Namespace }} wait --for=condition=available --timeout=60s deploy/{{ include "cryostat.deploymentName" . }}
+
+  export SVC_NAME=$(oc get services -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "cryostat.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=cryostat" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
+  oc -n {{ .Release.Namespace }} port-forward svc/$SVC_NAME {{ include "cryostat.core.service.port" . }}:{{ include "cryostat.core.service.scheme" . }}
+  ```
+  {{- $listNum = add1 $listNum }}
+{{- end }}
+
+{{ $listNum }}. Visit the application at:
+  ```
+{{- if .Values.core.route.enabled }}
+  echo {{ ternary "https" "http" .Values.core.route.tls.enabled }}://$(oc get route -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }} -o jsonpath="{.status.ingress[0].host}")
+{{- else if .Values.core.ingress.enabled }}
+{{- range $host := .Values.core.ingress.hosts -}}
+  {{- range .paths }}
+  {{ ternary "http" "https" (empty $.Values.core.ingress.tls) }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.core.service.type }}
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.core.service.type }}
+  echo http://$SERVICE_IP:{{ .Values.core.service.httpPort }}
+{{- else if contains "ClusterIP" .Values.core.service.type }}
+  {{ include "cryostat.core.service.scheme" . }}://localhost:{{ include "cryostat.core.service.port" . }}
+{{- end }}
+  ```
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_helpers.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_helpers.tpl
new file mode 100644
index 000000000..0a8e7e522
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_helpers.tpl
@@ -0,0 +1,195 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cryostat.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cryostat.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cryostat.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels.
+*/}}
+{{- define "cryostat.labels" -}}
+helm.sh/chart: {{ include "cryostat.chart" . }}
+{{ include "cryostat.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels.
+*/}}
+{{- define "cryostat.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cryostat.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: cryostat
+{{- end }}
+
+{{/*
+Create the name of the service account to use.
+*/}}
+{{- define "cryostat.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cryostat.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Cryostat service TLS enablement. Returns the string values "true" or "false".
+*/}}
+{{- define "cryostat.core.service.tls" -}}
+{{ or .Values.authentication.openshift.enabled .Values.oauth2Proxy.tls.selfSigned.enabled }}
+{{- end }}
+
+{{/*
+Cryostat service protocol. HTTPS if TLS is enabled, HTTP otherwise.
+*/}}
+{{- define "cryostat.core.service.scheme" -}}
+{{ ternary "https" "http" ( include "cryostat.core.service.tls" . | eq "true" ) }}
+{{- end }}
+
+{{/*
+Cryostat service port. 8443 if TLS is enabled, 8080 otherwise.
+*/}}
+{{- define "cryostat.core.service.port" -}}
+{{ ternary 8443 8080 ( ( include "cryostat.core.service.scheme" . ) | eq "https" ) }}
+{{- end }}
+
+{{/*
+Get or generate a default connection key for database.
+*/}}
+{{- define "cryostat.databaseConnectionKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-db" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current key. Do not regenerate.
+*/}}
+{{- $secret.data.CONNECTION_KEY -}}
+{{- else -}}
+{{/*
+    Generate new key.
+*/}}
+{{- (randAlphaNum 32) | b64enc | quote -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default encryption key for database.
+*/}}
+{{- define "cryostat.databaseEncryptionKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-db" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current key. Do not regenerate.
+*/}}
+{{- $secret.data.ENCRYPTION_KEY -}}
+{{- else -}}
+{{/*
+    Generate new key
+*/}}
+{{- (randAlphaNum 32) | b64enc | quote -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default secret key for object storage.
+*/}}
+{{- define "cryostat.objectStorageSecretKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-storage-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current secret. Do not regenerate.
+*/}}
+{{- $secret.data.STORAGE_ACCESS_KEY -}}
+{{- else -}}
+{{/*
+    Generate new secret
+*/}}
+{{- (randAlphaNum 32) | b64enc | quote -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default secret password key for report generators.
+*/}}
+{{- define "cryostat.reportsPassSecretKey" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-reports-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current secret. Do not regenerate.
+*/}}
+{{- $secret.data.REPORTS_PASS -}}
+{{- else -}}
+{{/*
+    Generate new secret
+*/}}
+{{- (randAlphaNum 32) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get or generate a default secret key for auth proxy cookies.
+*/}}
+{{- define "cryostat.cookieSecret" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-cookie-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use current secret. Do not regenerate.
+*/}}
+{{- $secret.data.COOKIE_SECRET -}}
+{{- else -}}
+{{/*
+    Generate new secret
+*/}}
+{{- (randAlphaNum 32) | b64enc -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+    Get sanitized list or defaults (if not disabled) as comma-separated list.
+*/}}
+{{- define "cryostat.commaSepList" -}}
+{{- $l := index . 0 -}}
+{{- $default := index . 1 -}}
+{{- $disableDefaults := index . 2 -}}
+{{- if and (not $l) (not $disableDefaults) -}}
+{{- $l = list $default -}}
+{{- end -}}
+{{- join "," (default list $l | compact | uniq) | quote -}}
+{{- end -}}
+
+{{/*
+Get the name for managed deployments.
+*/}}
+{{- define "cryostat.deploymentName" -}}
+{{- $version := semver .Chart.AppVersion -}}
+{{- printf "%s-v%d" (include "cryostat.fullname" .) $version.Major -}}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_oauth2Proxy.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_oauth2Proxy.tpl
new file mode 100644
index 000000000..db3fc6b90
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_oauth2Proxy.tpl
@@ -0,0 +1,54 @@
+{{/*
+Create OAuth2 Proxy container. Configurations defined in alpha_config.yaml
+*/}}
+{{- define "cryostat.oauth2Proxy" -}}
+- name: {{ printf "%s-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml (.Values.oauth2Proxy).securityContext | nindent 4 }}
+  image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
+  args:
+    - "--alpha-config=/etc/oauth2_proxy/alpha_config/alpha_config.yaml"
+  imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
+  env:
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: "http://localhost:4180/oauth2/callback"
+    - name: OAUTH2_PROXY_COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: "*"
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
+      value: write
+    - name: OAUTH2_PROXY_HTPASSWD_FILE
+      value: /etc/oauth2_proxy/basicauth/{{ .Values.authentication.basicAuth.filename }}
+    {{- end }}
+    {{- if not .Values.authentication.basicAuth.enabled }}
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: ".*"
+    {{- else }}
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: "^/health(/liveness)?$"
+    {{- end }}
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.oauth2Proxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: alpha-config
+      mountPath: /etc/oauth2_proxy/alpha_config
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - name: {{ .Release.Name }}-htpasswd
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+    {{- end }}
+    {{- if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+    - name: {{ .Release.Name }}-oauth2proxy-tls
+      mountPath: /etc/tls/private
+    {{- end }}
+{{- end}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_openshiftOauthProxy.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_openshiftOauthProxy.tpl
new file mode 100644
index 000000000..a4d703dc6
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_openshiftOauthProxy.tpl
@@ -0,0 +1,59 @@
+{{/*
+Create OpenShift OAuth Proxy container.
+*/}}
+{{- define "cryostat.openshiftOauthProxy" -}}
+- name: {{ printf "%s-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml .Values.openshiftOauthProxy.securityContext | nindent 4 }}
+  image: "{{ .Values.openshiftOauthProxy.image.repository }}:{{ .Values.openshiftOauthProxy.image.tag }}"
+  env:
+    - name: COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+  args:
+    - --skip-provider-button={{ not .Values.authentication.basicAuth.enabled }}
+    - --pass-access-token=false
+    - --pass-user-bearer-token=false
+    - --pass-basic-auth=false
+    - --upstream=http://localhost:8181/
+    - --upstream=http://localhost:3000/grafana/
+    - --cookie-secret=$(COOKIE_SECRET)
+    - --openshift-service-account={{ include "cryostat.serviceAccountName" . }}
+    - --proxy-websockets=true
+    - --http-address=0.0.0.0:4180
+    - --https-address=:8443
+    - --tls-cert=/etc/tls/private/tls.crt
+    - --tls-key=/etc/tls/private/tls.key
+    - --proxy-prefix=/oauth2
+    {{- if .Values.openshiftOauthProxy.accessReview.enabled }}
+    - --openshift-sar=[{{ tpl ( omit .Values.openshiftOauthProxy.accessReview "enabled" | toJson ) . }}]
+    - --openshift-delegate-urls={"/":{{ tpl ( omit .Values.openshiftOauthProxy.accessReview "enabled" | toJson ) . }}}
+    {{- end }}
+    - --bypass-auth-for=^/health(/liveness)?$
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - --htpasswd-file=/etc/openshift_oauth_proxy/basicauth/{{ .Values.authentication.basicAuth.filename }}
+    {{- end }}
+  imagePullPolicy: {{ .Values.openshiftOauthProxy.image.pullPolicy }}
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+    - containerPort: 8443
+      name: https
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.openshiftOauthProxy.resources | nindent 4 }}
+  volumeMounts:
+    {{- if .Values.authentication.basicAuth.enabled }}
+    - name: {{ .Release.Name }}-htpasswd
+      mountPath: /etc/openshift_oauth_proxy/basicauth
+      readOnly: true
+    {{- end }}
+    - name: {{ .Release.Name }}-proxy-tls
+      mountPath: /etc/tls/private
+  terminationMessagePath: /dev/termination-log
+  terminationMessagePolicy: File
+{{- end}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_reports_authproxy.tpl b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_reports_authproxy.tpl
new file mode 100644
index 000000000..90292e705
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/_reports_authproxy.tpl
@@ -0,0 +1,148 @@
+{{- define "cryostat.reportsAuthProxy" -}}
+{{- if (.Values.authentication.openshift).enabled }}
+- name: {{ printf "%s-reports-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml .Values.openshiftOauthProxy.securityContext | nindent 4 }}
+  image: "{{ .Values.openshiftOauthProxy.image.repository }}:{{ .Values.openshiftOauthProxy.image.tag }}"
+  env:
+    - name: COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+  args:
+    - --pass-access-token=false
+    - --pass-user-bearer-token=false
+    - --pass-basic-auth=false
+    - --htpasswd-file=/etc/oauth2_proxy/basicauth/htpasswd
+    - --upstream=http://localhost:10001/
+    - --cookie-secret=$(COOKIE_SECRET)
+    - --request-logging=true
+    - --openshift-service-account={{ include "cryostat.serviceAccountName" . }}
+    - --proxy-websockets=true
+    - --http-address=0.0.0.0:4180
+    - --https-address=:8443
+    - --tls-cert=/etc/tls/private/tls.crt
+    - --tls-key=/etc/tls/private/tls.key
+    - --proxy-prefix=/oauth2
+    - --bypass-auth-for=^/health$
+  imagePullPolicy: {{ .Values.openshiftOauthProxy.image.pullPolicy }}
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+    - containerPort: 8443
+      name: https
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.openshiftOauthProxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: {{ .Release.Name }}-proxy-tls
+      mountPath: /etc/tls/private
+    - name: {{ .Release.Name }}-reports-secret
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+  terminationMessagePath: /dev/termination-log
+  terminationMessagePolicy: File
+{{- else if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+- name: {{ printf "%s-reports-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml (.Values.oauth2Proxy).securityContext | nindent 4 }}
+  image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
+  imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
+  env:
+    - name: OAUTH2_PROXY_CLIENT_ID
+      value: dummy
+    - name: OAUTH2_PROXY_CLIENT_SECRET
+      value: none
+    - name: OAUTH2_PROXY_HTTP_ADDRESS
+      value: 0.0.0.0:4180
+    - name: OAUTH2_PROXY_HTTPS_ADDRESS
+      value: :8443
+    - name: OAUTH2_PROXY_TLS_CERT_FILE
+      value: /etc/tls/private/cert
+    - name: OAUTH2_PROXY_TLS_KEY_FILE
+      value: /etc/tls/private/key
+    - name: OAUTH2_PROXY_UPSTREAMS
+      value: http://localhost:10001/
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: "http://localhost:4180/oauth2/callback"
+    - name: OAUTH2_PROXY_COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: "*"
+    - name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
+      value: write
+    - name: OAUTH2_PROXY_HTPASSWD_FILE
+      value: /etc/oauth2_proxy/basicauth/htpasswd
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: "^/health$"
+    - name: OAUTH2_PROXY_PROXY_WEBSOCKETS
+      value: "false"
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+    - containerPort: 8443
+      name: https
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.oauth2Proxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: {{ .Release.Name }}-reports-secret
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+    {{- if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+    - name: {{ .Release.Name }}-oauth2proxy-reports-tls
+      mountPath: /etc/tls/private
+    {{- end }}
+{{- else }}
+- name: {{ printf "%s-reports-%s" .Chart.Name "authproxy" }}
+  securityContext:
+    {{- toYaml (.Values.oauth2Proxy).securityContext | nindent 4 }}
+  image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
+  imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
+  env:
+    - name: OAUTH2_PROXY_CLIENT_ID
+      value: dummy
+    - name: OAUTH2_PROXY_CLIENT_SECRET
+      value: none
+    - name: OAUTH2_PROXY_HTTP_ADDRESS
+      value: 0.0.0.0:4180
+    - name: OAUTH2_PROXY_UPSTREAMS
+      value: http://localhost:10001/
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: "http://localhost:4180/oauth2/callback"
+    - name: OAUTH2_PROXY_COOKIE_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
+          key: COOKIE_SECRET
+          optional: false
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: "*"
+    - name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
+      value: write
+    - name: OAUTH2_PROXY_HTPASSWD_FILE
+      value: /etc/oauth2_proxy/basicauth/htpasswd
+    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
+      value: "^/health$"
+    - name: OAUTH2_PROXY_PROXY_WEBSOCKETS
+      value: "false"
+  ports:
+    - containerPort: 4180
+      name: http
+      protocol: TCP
+  resources:
+    {{- toYaml .Values.oauth2Proxy.resources | nindent 4 }}
+  volumeMounts:
+    - name: {{ .Release.Name }}-reports-secret
+      mountPath: /etc/oauth2_proxy/basicauth
+      readOnly: true
+{{- end }}
+{{- end}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/alpha_config.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/alpha_config.yaml
new file mode 100644
index 000000000..63094fe45
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/alpha_config.yaml
@@ -0,0 +1,38 @@
+{{/*
+   Alpha Configuration is not used with OpenShift OAuth Proxy
+*/}}
+{{- if not (.Values.authentication.openshift).enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-alpha-config
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+data:
+  alpha_config.yaml: |-
+    server:
+      BindAddress: http://0.0.0.0:4180
+      {{- if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+      SecureBindAddress: https://0.0.0.0:8443
+      TLS:
+        Key:
+          fromFile: /etc/tls/private/key
+        Cert:
+          fromFile: /etc/tls/private/cert
+      {{- end}}
+    upstreamConfig:
+      proxyRawPath: true
+      upstreams:
+        - id: cryostat
+          path: /
+          uri: http://localhost:8181
+        - id: grafana
+          path: /grafana/
+          uri: http://localhost:3000
+    providers:
+      - id: dummy
+        name: Unused - Sign In Below
+        clientId: CLIENT_ID
+        clientSecret: CLIENT_SECRET
+        provider: google
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/clusterrolebinding.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..4721c7c3b
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/clusterrolebinding.yaml
@@ -0,0 +1,16 @@
+{{- if and (.Values.rbac.create) (.Values.authentication.openshift.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cryostat.fullname" . }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.authentication.openshift.clusterRole.name }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cryostat.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cookie_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cookie_secret.yaml
new file mode 100644
index 000000000..76b44fc0e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cookie_secret.yaml
@@ -0,0 +1,11 @@
+{{- if empty .Values.authentication.cookieSecretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-cookie-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+data:
+  COOKIE_SECRET: {{ include "cryostat.cookieSecret" . }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_deployment.yaml
new file mode 100644
index 000000000..2e222b9f1
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_deployment.yaml
@@ -0,0 +1,250 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: cryostat
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: cryostat
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.core.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: cryostat
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "cryostat.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        {{- if (.Values.authentication.openshift).enabled }}
+        {{- include "cryostat.openshiftOauthProxy" . | nindent 8 }}
+        {{- else }}
+        {{- include "cryostat.oauth2Proxy" . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.core.securityContext | nindent 12 }}
+          image: "{{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}"
+          imagePullPolicy: {{ .Values.core.image.pullPolicy }}
+          env:
+          - name: QUARKUS_HTTP_HOST
+            value: localhost
+          - name: QUARKUS_LOG_LEVEL
+            value: {{ .Values.core.debug.log.level }}
+          - name: QUARKUS_HTTP_PORT
+            value: "8181"
+          - name: QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING
+            value: 'true'
+          - name: QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED
+            value: 'true'
+          - name: QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST
+            value: 'true'
+          - name: QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX
+            value: 'true'
+          - name: QUARKUS_HIBERNATE_ORM_DATABASE_GENERATION
+            value: none
+          - name: QUARKUS_HIBERNATE_ORM_SQL_LOAD_SCRIPT
+            value: no-file
+          {{- if gt (int (.Values.reports).replicas) 0 }}
+          - name: REPORTS_PASS_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-reports-secret" .Release.Name) .Values.reports.reportsSecretName }}
+                key: REPORTS_PASS
+                optional: false
+          # TODO TLS trust
+          - name: QUARKUS_TLS_TRUST_ALL
+            value: "true"
+          - name: QUARKUS_REST_CLIENT_EXTENSIONS_API_VERIFY_HOST
+            value: "false"
+          - name: QUARKUS_REST_CLIENT_REPORTS_URL
+            value: {{ printf "%s://cryostat:$(REPORTS_PASS_SECRET_KEY)@%s-reports.%s.svc:%d" (include "cryostat.core.service.scheme" .) $fullName $.Release.Namespace (int .Values.reports.service.httpPort) }}
+          {{- end }}
+          - name: QUARKUS_DATASOURCE_USERNAME
+            value: cryostat
+          - name: QUARKUS_DATASOURCE_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-db" .Release.Name) .Values.core.databaseSecretName }}
+                key: CONNECTION_KEY
+                optional: false
+          - name: QUARKUS_DATASOURCE_JDBC_URL
+            value: jdbc:postgresql://{{ $fullName }}-db:5432/cryostat
+          - name: STORAGE_BUCKETS_ARCHIVES_NAME
+            value: archivedrecordings
+          - name: QUARKUS_S3_ENDPOINT_OVERRIDE
+            value: http://{{ $fullName }}-storage:8333
+          - name: QUARKUS_S3_PATH_STYLE_ACCESS
+            value: "true"
+          - name: QUARKUS_S3_AWS_REGION
+            value: us-east-1
+          - name: QUARKUS_S3_AWS_CREDENTIALS_TYPE
+            value: static
+          - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID
+            value: cryostat
+          - name: AWS_ACCESS_KEY_ID
+            value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID)
+          - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-storage-secret" .Release.Name) .Values.storage.storageSecretName }}
+                key: STORAGE_ACCESS_KEY
+                optional: false
+          - name: AWS_SECRET_ACCESS_KEY
+            value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY)
+          - name: GRAFANA_DATASOURCE_URL
+            value: http://localhost:8800
+          - name: GRAFANA_DASHBOARD_URL
+            value: http://localhost:3000
+          - name: GRAFANA_DASHBOARD_EXT_URL
+            value: /grafana/
+          {{- if .Values.core.discovery.kubernetes.enabled }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_ENABLED
+            value: "true"
+          {{- with .Values.core.discovery.kubernetes }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_NAMESPACES
+            value: {{ include "cryostat.commaSepList" (list .namespaces $.Release.Namespace .installNamespaceDisabled) }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NAMES
+            value: {{ include "cryostat.commaSepList" (list .portNames "jfr-jmx" .builtInPortNamesDisabled) }}
+          - name: CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NUMBERS
+            value: {{ include "cryostat.commaSepList" (list .portNumbers 9091 .builtInPortNumbersDisabled) }}
+          {{- end }}
+          {{- end }}
+          ports:
+            - containerPort: 8181
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - curl
+                - --fail
+                - http://localhost:8181/health/liveness
+          startupProbe:
+            exec:
+              command:
+                - curl
+                - --fail
+                - http://localhost:8181/health/liveness
+            failureThreshold: 18
+          resources:
+            {{- toYaml .Values.core.resources | nindent 12 }}
+          volumeMounts:
+          {{- range .Values.core.config.eventTemplates.configMapNames }}
+            - name: {{ . }}
+              mountPath: /opt/cryostat.d/templates.d/{{ . }}
+              readOnly: true
+          {{- end }}
+          {{- range .Values.core.config.tlsTruststore.secretNames }}
+            - name: {{ . }}
+              mountPath: /truststore/{{ . }}
+              readOnly: true
+          {{- end }}
+        - name: {{ printf "%s-%s" .Chart.Name "grafana" }}
+          securityContext:
+            {{- toYaml .Values.grafana.securityContext | nindent 12 }}
+          image: "{{ .Values.grafana.image.repository }}:{{ .Values.grafana.image.tag }}"
+          imagePullPolicy: {{ .Values.grafana.image.pullPolicy }}
+          env:
+          - name: GF_AUTH_ANONYMOUS_ENABLED
+            value: "true"
+          - name: GF_SERVER_DOMAIN
+            value: localhost
+          - name: GF_SERVER_ROOT_URL
+            value: http://localhost:4180/grafana/
+          - name: GF_SERVER_SERVE_FROM_SUB_PATH
+            value: "true"
+          - name: JFR_DATASOURCE_URL
+            value: http://localhost:8800
+          ports:
+          - containerPort: 3000
+            protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3000
+          resources:
+            {{- toYaml .Values.grafana.resources | nindent 12 }}
+        - name: {{ printf "%s-%s" .Chart.Name "jfr-datasource" }}
+          securityContext:
+            {{- toYaml .Values.datasource.securityContext | nindent 12 }}
+          image: "{{ .Values.datasource.image.repository }}:{{ .Values.datasource.image.tag }}"
+          imagePullPolicy: {{ .Values.datasource.image.pullPolicy }}
+          env:
+          - name: LISTEN_HOST
+            value: localhost
+          - name: QUARKUS_HTTP_PORT
+            value: "8800"
+          ports:
+          - containerPort: 8800
+            protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+              - curl
+              - --fail
+              - http://localhost:8800
+          resources:
+            {{- toYaml .Values.datasource.resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.core.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.core.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.core.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if not (.Values.authentication.openshift).enabled }}
+      - name: alpha-config
+        configMap:
+          name: {{ .Release.Name }}-alpha-config
+      {{- end }}
+      {{- if .Values.authentication.basicAuth.enabled }}
+      - name: {{ .Release.Name }}-htpasswd
+        secret:
+          defaultMode: 0440
+          secretName: {{ .Values.authentication.basicAuth.secretName }}
+      {{- end }}
+      {{- if (.Values.authentication.openshift).enabled }}
+      - name: {{ .Release.Name }}-proxy-tls
+        secret:
+          secretName: {{ .Release.Name }}-proxy-tls
+      {{- else if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+      - name: {{ .Release.Name }}-oauth2proxy-tls
+        secret:
+          secretName: {{ .Release.Name }}-oauth2proxy-tls
+      {{- end }}
+      {{- range .Values.core.config.eventTemplates.configMapNames}}
+      - name: {{ . }}
+        configMap:
+          name: {{ . }}
+      {{- end }}
+      {{- range .Values.core.config.tlsTruststore.secretNames }}
+      - name: {{ . }}
+        secret:
+          secretName: {{ . }}
+      {{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_service.yaml
new file mode 100644
index 000000000..36261e437
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_service.yaml
@@ -0,0 +1,31 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: cryostat
+  {{- if (.Values.authentication.openshift).enabled }}
+  annotations:
+    service.alpha.openshift.io/serving-cert-secret-name: {{ .Release.Name }}-proxy-tls
+  {{- end }}
+spec:
+  type: {{ .Values.core.service.type }}
+  ports:
+    - port: {{ .Values.core.service.httpPort }}
+      targetPort: 4180
+      protocol: TCP
+      name: http
+      appProtocol: http
+    {{- if ( include "cryostat.core.service.tls" . | eq "true" ) }}
+    - port: 443
+      targetPort: 8443
+      protocol: TCP
+      name: https
+      appProtocol: https
+    {{- end }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_tls_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_tls_secret.yaml
new file mode 100644
index 000000000..0d057454a
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/cryostat_tls_secret.yaml
@@ -0,0 +1,15 @@
+{{- if ( include "cryostat.core.service.tls" . | eq "true" ) }}
+{{- $fullName := include "cryostat.fullname" . }}
+{{- $cert := genSelfSignedCert $fullName nil nil 365 }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-oauth2proxy-tls
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+immutable: true
+data:
+  cert: {{ $cert.Cert | b64enc }}
+  key: {{ $cert.Key | b64enc }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_deployment.yaml
new file mode 100644
index 000000000..837195977
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_deployment.yaml
@@ -0,0 +1,98 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}-db
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: db
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: db
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.db.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: db
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ printf "%s-%s" .Chart.Name "db" }}
+          securityContext:
+            {{- toYaml (.Values.db).securityContext | nindent 12 }}
+          image: "{{ (.Values.db).image.repository }}:{{ (.Values.db).image.tag }}"
+          imagePullPolicy: {{ (.Values.db).image.pullPolicy }}
+          env:
+          - name: POSTGRESQL_USER
+            value: cryostat
+          - name: POSTGRESQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-db" .Release.Name) .Values.core.databaseSecretName }}
+                key: CONNECTION_KEY
+                optional: false
+          - name: POSTGRESQL_DATABASE
+            value: cryostat
+          - name: PG_ENCRYPT_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-db" .Release.Name) .Values.core.databaseSecretName }}
+                key: ENCRYPTION_KEY
+                optional: false
+          ports:
+            - containerPort: 5432
+              protocol: TCP
+          volumeMounts:
+          - mountPath: /var/lib/pgsql/data
+            name: {{ .Chart.Name }}-db
+            subPath: postgres
+          readinessProbe:
+            exec:
+              command:
+              - pg_isready
+              - -U
+              - cryostat
+              - -d
+              - cryostat
+          resources:
+            {{- toYaml (.Values.db).resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.db.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.db.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.db.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if ((.Values.db.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-db
+        persistentVolumeClaim:
+          claimName: {{ .Release.Name }}-db
+      {{- end }}
+      {{- if not ((.Values.db.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-db
+        emptyDir: {}
+      {{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_pvc.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_pvc.yaml
new file mode 100644
index 000000000..78c2abc34
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_pvc.yaml
@@ -0,0 +1,27 @@
+{{- if ((.Values.db.pvc).enabled) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cryostat.fullname" . }}-db
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .Values.db.pvc.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.db.pvc.accessModes }}
+  accessModes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.db.pvc.storage }}
+  {{- if kindIs "string" .Values.db.pvc.storageClassName }}
+  storageClassName: {{ .Values.db.pvc.storageClassName | quote }}
+  {{- end }}
+  {{- with .Values.db.pvc.selector }}
+  selector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_secret.yaml
new file mode 100644
index 000000000..798638375
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_secret.yaml
@@ -0,0 +1,13 @@
+{{- if empty .Values.core.databaseSecretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-db
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+immutable: true
+data:
+  ENCRYPTION_KEY: {{ include "cryostat.databaseEncryptionKey" . }}
+  CONNECTION_KEY: {{ include "cryostat.databaseConnectionKey" . }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_service.yaml
new file mode 100644
index 000000000..402e189fb
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/db_service.yaml
@@ -0,0 +1,16 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}-db
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: db
+spec:
+  type: {{ .Values.db.service.type }}
+  ports:
+    - port: {{ .Values.db.service.port }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: db
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/ingress.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/ingress.yaml
new file mode 100644
index 000000000..4a051f66c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/ingress.yaml
@@ -0,0 +1,70 @@
+{{- define "cryostat.createIngress" }}
+{{- $svcName := index . 0 }}
+{{- $svcPort := index . 1 }}
+{{- $ := index . 2 }}
+{{- with index . 3 }}
+{{- if and .ingress.className (not (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .ingress.annotations "kubernetes.io/ingress.class" .ingress.className}}
+  {{- end }}
+{{- end }}
+---
+{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" $.Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $svcName }}
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .ingress.className (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .ingress.className }}
+  {{- end }}
+  {{- if .ingress.tls }}
+  tls:
+    {{- range .ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $svcName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
+{{- end }}
+
+{{- $fullName := include "cryostat.fullname" . -}}
+{{- if .Values.core.ingress.enabled }}
+{{- include "cryostat.createIngress" (list $fullName .Values.core.service.httpPort $ .Values.core)}}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/networkpolicy_ingress.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/networkpolicy_ingress.yaml
new file mode 100644
index 000000000..b827a8e21
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/networkpolicy_ingress.yaml
@@ -0,0 +1,87 @@
+{{- if ((.Values.networkPolicy.ingress).enabled) }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-cryostat-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: cryostat
+  ingress:
+    - from:
+      - namespaceSelector: {}
+      ports:
+        - protocol: TCP
+          port: 4180
+        - protocol: TCP
+          port: 8443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-reports-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: reports
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "cryostat.selectorLabels" $ | nindent 12 }}
+            app.kubernetes.io/component: cryostat
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      ports:
+        - protocol: TCP
+          port: 4180
+        - protocol: TCP
+          port: 8443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-db-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: db
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "cryostat.selectorLabels" $ | nindent 12 }}
+            app.kubernetes.io/component: cryostat
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-storage-internal-ingress
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" $ | nindent 6 }}
+      app.kubernetes.io/component: storage
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "cryostat.selectorLabels" $ | nindent 12 }}
+            app.kubernetes.io/component: cryostat
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      ports:
+        - protocol: TCP
+          port: 8333
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_deployment.yaml
new file mode 100644
index 000000000..b3503f00b
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_deployment.yaml
@@ -0,0 +1,93 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+{{- if gt (int (.Values.reports).replicas) 0 -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}-reports
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: reports
+spec:
+  replicas: {{ (.Values.reports).replicas }}
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: reports
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.reports.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: reports
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        {{- include "cryostat.reportsAuthProxy" . | nindent 8 }}
+        - name: {{ printf "%s-%s" .Chart.Name "reports" }}
+          securityContext:
+            {{- toYaml (.Values.reports).securityContext | nindent 12 }}
+          image: "{{ (.Values.reports).image.repository }}:{{ (.Values.reports).image.tag }}"
+          imagePullPolicy: {{ (.Values.reports).image.pullPolicy }}
+          env:
+            - name: QUARKUS_HTTP_PORT
+              value: "{{ .Values.reports.service.httpPort }}"
+            - name: QUARKUS_LOG_LEVEL
+              value: {{ .Values.reports.debug.log.level }}
+          ports:
+            - containerPort: {{ .Values.reports.service.httpPort }}
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: "/health"
+              port: {{ .Values.reports.service.httpPort }}
+            periodSeconds: 10
+            failureThreshold: 9
+          livenessProbe:
+            httpGet:
+              path: "/health"
+              port: {{ .Values.reports.service.httpPort }}
+            periodSeconds: 10
+            failureThreshold: 2
+          resources:
+            {{- toYaml (.Values.reports).resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.reports.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.reports.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.reports.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      - name: {{ .Release.Name }}-reports-secret
+        secret:
+          defaultMode: 0440
+          secretName: {{ .Release.Name }}-reports-secret
+      {{- if (.Values.authentication.openshift).enabled }}
+      - name: {{ .Release.Name }}-proxy-tls
+        secret:
+          secretName: {{ .Release.Name }}-proxy-tls
+      {{- else if .Values.oauth2Proxy.tls.selfSigned.enabled }}
+      - name: {{ .Release.Name }}-oauth2proxy-reports-tls
+        secret:
+          secretName: {{ .Release.Name }}-oauth2proxy-reports-tls
+      {{- end }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_secret.yaml
new file mode 100644
index 000000000..988de13c8
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_secret.yaml
@@ -0,0 +1,13 @@
+{{- if empty .Values.reports.reportsSecretName -}}
+{{- $secretKey := include "cryostat.reportsPassSecretKey" . -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-reports-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+data:
+  REPORTS_PASS: {{ $secretKey | b64enc }}
+  htpasswd: {{ htpasswd "cryostat" $secretKey | b64enc }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_service.yaml
new file mode 100644
index 000000000..a54836a63
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_service.yaml
@@ -0,0 +1,18 @@
+{{- if gt (int (.Values.reports).replicas) 0 -}}
+{{- $fullName := include "cryostat.fullname" . -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}-reports
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: reports
+spec:
+  type: {{ .Values.reports.service.type }}
+  ports:
+    - port: {{ .Values.reports.service.httpPort }}
+      targetPort: {{ include "cryostat.core.service.scheme" . }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: reports
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_tls_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_tls_secret.yaml
new file mode 100644
index 000000000..79dbf2582
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/reports_tls_secret.yaml
@@ -0,0 +1,15 @@
+{{- if ( include "cryostat.core.service.tls" . | eq "true" ) }}
+{{- $fullName := include "cryostat.fullname" . }}
+{{- $cert := genSelfSignedCert (printf "%s-reports" $fullName) nil nil 365 }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-oauth2proxy-reports-tls
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+immutable: true
+data:
+  cert: {{ $cert.Cert | b64enc }}
+  key: {{ $cert.Key | b64enc }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/role.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/role.yaml
new file mode 100644
index 000000000..98f96c609
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/role.yaml
@@ -0,0 +1,61 @@
+{{- define "cryostat.createRole" -}}
+{{- $ns := index .  0 -}}
+{{- with index . 1 -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "cryostat.fullname" . }}
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - replicationcontrollers
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - replicasets
+  - deployments
+  - daemonsets
+  - statefulsets
+  verbs:
+  - get
+- apiGroups:
+  - apps.openshift.io
+  resources:
+  - deploymentconfigs
+  verbs:
+  - get
+- apiGroups:
+  - route.openshift.io
+  resources:
+  - routes
+  verbs:
+  - get
+  - list
+{{- end -}}
+{{- end -}}
+
+{{- if and .Values.rbac.create .Values.core.discovery.kubernetes.enabled -}}
+{{- $watchNs := compact (default list .Values.core.discovery.kubernetes.namespaces) | uniq -}}
+{{- if and (not $watchNs) (not .Values.core.discovery.kubernetes.installNamespaceDisabled) -}}
+{{- $watchNs = list .Release.Namespace -}}
+{{- end -}}
+{{- range $ns := $watchNs }}
+{{ include "cryostat.createRole" (list $ns $) }}
+{{- end -}}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/rolebinding.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/rolebinding.yaml
new file mode 100644
index 000000000..b24049667
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/rolebinding.yaml
@@ -0,0 +1,31 @@
+{{- define "cryostat.createRolebinding" -}}
+{{- $ns := index .  0 -}}
+{{- with index . 1 -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "cryostat.fullname" . }}
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "cryostat.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cryostat.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}
+
+{{- if and .Values.rbac.create .Values.core.discovery.kubernetes.enabled -}}
+{{- $watchNs := compact (default list .Values.core.discovery.kubernetes.namespaces) | uniq -}}
+{{- if and (not $watchNs) (not .Values.core.discovery.kubernetes.installNamespaceDisabled) -}}
+{{- $watchNs = list .Release.Namespace -}}
+{{- end -}}
+{{- range $ns := $watchNs }}
+{{ include "cryostat.createRolebinding" (list $ns $) }}
+{{- end -}}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/route.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/route.yaml
new file mode 100644
index 000000000..608269c11
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/route.yaml
@@ -0,0 +1,50 @@
+{{- define "cryostat.createRoute" }}
+{{- $svcName := index . 0 }}
+{{- $targetPort := index . 1 }}
+{{- $ := index . 2 }}
+{{- with index . 3 }}
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: {{ $svcName }}
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .route.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  to:
+    kind: Service
+    name: {{ $svcName }}
+  port:
+    targetPort: {{ $targetPort }}
+{{- if .route.tls.enabled }}
+  tls:
+    termination: {{ .route.tls.termination }}
+    insecureEdgeTerminationPolicy: {{ .route.tls.insecureEdgeTerminationPolicy }}
+  {{- if .route.tls.key }}
+    key: |-
+      {{- .route.tls.key | nindent 6 }}
+  {{- end }}
+  {{- if .route.tls.destinationCACertificate }}
+    destinationCACertificate: |-
+      {{- .route.tls.destinationCACertificate | nindent 6 }}
+  {{- end }}
+  {{- if .route.tls.caCertificate }}
+    caCertificate: |-
+      {{- .route.tls.caCertificate | nindent 6 }}
+  {{- end }}
+  {{- if .route.tls.certificate }}
+    certificate: |-
+      {{- .route.tls.certificate | nindent 6 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- $fullName := include "cryostat.fullname" . -}}
+{{- if .Values.core.route.enabled }}
+{{- include "cryostat.createRoute" (list $fullName 4180 $ .Values.core)}}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/serviceaccount.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/serviceaccount.yaml
new file mode 100644
index 000000000..e6da50e61
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/serviceaccount.yaml
@@ -0,0 +1,17 @@
+{{- if (.Values.authentication.openshift).enabled -}}
+{{- $fullName := include "cryostat.fullname" . -}}
+{{- $redirectAnnotations := dict "serviceaccounts.openshift.io/oauth-redirectreference.primary" (printf "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"%s\"}}" $fullName) -}}
+{{- $_ := merge .Values.serviceAccount.annotations $redirectAnnotations -}}
+{{- end -}}
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "cryostat.serviceAccountName" . }}
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_deployment.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_deployment.yaml
new file mode 100644
index 000000000..a7aa6084f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_deployment.yaml
@@ -0,0 +1,112 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cryostat.deploymentName" . }}-storage
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "cryostat.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: storage
+  template:
+    metadata:
+      annotations:
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.storage.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "cryostat.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: storage
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ printf "%s-%s" .Chart.Name "storage" }}
+          securityContext:
+            {{- toYaml (.Values.storage).securityContext | nindent 12 }}
+          image: "{{ (.Values.storage).image.repository }}:{{ (.Values.storage).image.tag }}"
+          imagePullPolicy: {{ (.Values.storage).image.pullPolicy }}
+          env:
+          - name: CRYOSTAT_BUCKETS
+            value: archivedrecordings,archivedreports,eventtemplates,probes
+          - name: CRYOSTAT_ACCESS_KEY
+            value: cryostat
+          - name: CRYOSTAT_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ default (printf "%s-storage-secret" .Release.Name) .Values.storage.storageSecretName }}
+                key: STORAGE_ACCESS_KEY
+                optional: false
+          - name: DATA_DIR
+            value: /data
+          - name: IP_BIND
+            value: 0.0.0.0
+          - name: REST_ENCRYPTION_ENABLE
+            value: "{{ .Values.storage.encryption.enabled | ternary 1 0 }}"
+          ports:
+            - containerPort: 8333
+              protocol: TCP
+          volumeMounts:
+          - mountPath: /data
+            name: {{ .Chart.Name }}-storage
+            subPath: seaweed
+          startupProbe:
+            httpGet:
+              path: "/status"
+              port: 8333
+            periodSeconds: 10
+            failureThreshold: 9
+          livenessProbe:
+            httpGet:
+              path: "/status"
+              port: 8333
+            periodSeconds: 10
+            failureThreshold: 2
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - echo s3.bucket.list | weed shell | [[ "$(</dev/stdin)" == *"archivedrecordings"* ]]
+            failureThreshold: 2
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            {{- toYaml (.Values.storage).resources | nindent 12 }}
+      {{- with (default .Values.nodeSelector .Values.storage.nodeSelector) }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.affinity .Values.storage.affinity) }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (default .Values.tolerations .Values.storage.tolerations) }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if ((.Values.storage.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-storage
+        persistentVolumeClaim:
+          claimName: {{ .Release.Name }}-storage
+      {{- end }}
+      {{- if not ((.Values.storage.pvc).enabled) }}
+      - name: {{ .Chart.Name }}-storage
+        emptyDir: {}
+      {{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_pvc.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_pvc.yaml
new file mode 100644
index 000000000..e44cc5641
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_pvc.yaml
@@ -0,0 +1,27 @@
+{{- if ((.Values.storage.pvc).enabled) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cryostat.fullname" . }}-storage
+  {{- $labels := include "cryostat.labels" $ | nindent 4 }}
+  labels: {{ $labels }}
+  {{- with .Values.storage.pvc.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.storage.pvc.accessModes }}
+  accessModes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.storage.pvc.storage }}
+  {{- if kindIs "string" .Values.storage.pvc.storageClassName }}
+  storageClassName: {{ .Values.storage.pvc.storageClassName | quote }}
+  {{- end }}
+  {{- with .Values.storage.pvc.selector }}
+  selector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_secret.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_secret.yaml
new file mode 100644
index 000000000..b402eaaa0
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_secret.yaml
@@ -0,0 +1,11 @@
+{{- if empty .Values.storage.storageSecretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-storage-secret
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+type: Opaque
+data:
+  STORAGE_ACCESS_KEY: {{ include "cryostat.objectStorageSecretKey" . }}
+{{- end -}}
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_service.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_service.yaml
new file mode 100644
index 000000000..0d074d08e
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/storage_service.yaml
@@ -0,0 +1,16 @@
+{{- $fullName := include "cryostat.fullname" . -}}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}-storage
+  labels:
+    {{- include "cryostat.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  type: {{ .Values.storage.service.type }}
+  ports:
+    - port: {{ .Values.storage.service.port }}
+  selector:
+    {{- include "cryostat.selectorLabels" $ | nindent 4 }}
+    app.kubernetes.io/component: storage
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/tests/test-core-connection.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/tests/test-core-connection.yaml
new file mode 100644
index 000000000..f5a087c89
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/tests/test-core-connection.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "cryostat.fullname" . }}-test-core-connection"
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: test-core-connection
+    charts.cryostat.io/role: helm-test
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: curl
+      image: registry.access.redhat.com/ubi8/ubi:latest
+      command:
+        - '/bin/bash'
+        - '-exc'
+        - >
+          dnf install --disableplugin=subscription-manager -yq jq;
+          curl -sSf --retry 10 --retry-connrefused http://{{ include "cryostat.fullname" . }}:{{ .Values.core.service.httpPort }}/health | tee /tmp/out.json;
+          cat /tmp/out.json;
+          {{- if hasSuffix "-dev" .Chart.AppVersion }}
+          jq -e '{{ printf "(.cryostatVersion | test(\"^v%s-snapshot$\"))" (.Chart.AppVersion | trimSuffix "-dev" | squote) }}' /tmp/out.json;
+          {{- else }}
+          jq -e '{{ printf "(.cryostatVersion | test(\"^v%s\"))" (.Chart.AppVersion | replace "-" "." | squote) }}' /tmp/out.json;
+          {{- end }}
+          jq -e '.datasourceAvailable' /tmp/out.json
+  restartPolicy: Never
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/tests/test-grafana-connection.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/tests/test-grafana-connection.yaml
new file mode 100644
index 000000000..84b3dfcea
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/templates/tests/test-grafana-connection.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "cryostat.fullname" . }}-test-grafana-connection"
+  labels:
+    {{- include "cryostat.labels" . | nindent 4 }}
+    app.kubernetes.io/component: test-grafana-connection
+    charts.cryostat.io/role: helm-test
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: curl
+      image: registry.access.redhat.com/ubi8/ubi:latest
+      command:
+        - '/bin/bash'
+        - '-exc'
+        - curl -sSf --retry 10 --retry-connrefused http://{{ include "cryostat.fullname" . }}:{{ .Values.core.service.httpPort }}/grafana/api/health
+  restartPolicy: Never
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/alpha_config_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/alpha_config_test.yaml
new file mode 100644
index 000000000..c0312ad38
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/alpha_config_test.yaml
@@ -0,0 +1,45 @@
+suite: test alpha_config.yaml
+templates:
+  - templates/alpha_config.yaml
+
+tests:
+  - it: should create configmap with correct alpha configurations
+    asserts:
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "server:\\s*BindAddress: http://0.0.0.0:4180"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "upstreamConfig:\\s*proxyRawPath: true\\s*upstreams:\\s*- id: cryostat\\s*path: /\\s*uri: http://localhost:8181"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "- id: grafana\\s*path: /grafana/\\s*uri: http://localhost:3000"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "providers:\\s*- id: dummy\\s*name: Unused - Sign In Below\\s*clientId: CLIENT_ID\\s*clientSecret: CLIENT_SECRET\\s*provider: google"
+
+  - it: should create configmap with correct alpha configurations when self-signed TLS is enabled
+    set:
+      oauth2Proxy.tls.selfSigned.enabled: true
+    asserts:
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "server:\\s*BindAddress: http://0.0.0.0:4180\\s*SecureBindAddress: https://0.0.0.0:8443"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "upstreamConfig:\\s*proxyRawPath: true\\s*upstreams:\\s*- id: cryostat\\s*path: /\\s*uri: http://localhost:8181"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "- id: grafana\\s*path: /grafana/\\s*uri: http://localhost:3000"
+      - matchRegex:
+          path: data['alpha_config.yaml']
+          pattern: "providers:\\s*- id: dummy\\s*name: Unused - Sign In Below\\s*clientId: CLIENT_ID\\s*clientSecret: CLIENT_SECRET\\s*provider: google"
+
+  - it: should not create alpha_config when openshift authentication is enabled
+    set:
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/clusterrolebinding_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/clusterrolebinding_test.yaml
new file mode 100644
index 000000000..0d867408c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/clusterrolebinding_test.yaml
@@ -0,0 +1,65 @@
+suite: test clusterrolebinding.yaml
+templates:
+  - clusterrolebinding.yaml
+
+tests:
+  - it: should create a ClusterRoleBinding when RBAC and OpenShift authentication are enabled
+    set:
+      rbac.create: true
+      authentication.openshift.enabled: true
+      authentication.openshift.clusterRole.name: system:auth-delegator
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: roleRef.apiGroup
+          value: rbac.authorization.k8s.io
+      - equal:
+          path: roleRef.kind
+          value: ClusterRole
+      - equal:
+          path: roleRef.name
+          value: system:auth-delegator
+      - equal:
+          path: subjects[0].kind
+          value: ServiceAccount
+      - equal:
+          path: subjects[0].name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: subjects[0].namespace
+          value: NAMESPACE
+
+  - it: should create a ClusterRoleBinding with a custom OpenShift cluster role
+    set:
+      rbac.create: true
+      authentication.openshift.enabled: true
+      authentication.openshift.clusterRole.name: custom-clusterrole
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: roleRef.name
+          value: custom-clusterrole
+
+
+  - it: should not create a ClusterRoleBinding when RBAC is disabled
+    set:
+      rbac.create: false
+      authentication.openshift.enabled: true
+      authentication.openshift.clusterRole.name: system:auth-delegator
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create a ClusterRoleBinding when OpenShift authentication is disabled
+    set:
+      rbac.create: true
+      authentication.openshift.enabled: false
+      authentication.openshift.clusterRole.name: system:auth-delegator
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cookie_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cookie_secret_test.yaml
new file mode 100644
index 000000000..302e69316
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cookie_secret_test.yaml
@@ -0,0 +1,36 @@
+suite: test cookie_secret.yaml
+templates:
+  - cookie_secret.yaml
+
+tests:
+  - it: should create a Cookie Secret with correct settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cookie-secret
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.COOKIE_SECRET
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.3-redhat
+            helm.sh/chart: cryostat-2.0.3
+
+  - it: should not create a cookie secret if authentication.cookieSecretName is set
+    set:
+      authentication.cookieSecretName: "custom-cookie-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_deployment_test.yaml
new file mode 100644
index 000000000..5bce3bc6f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_deployment_test.yaml
@@ -0,0 +1,737 @@
+suite: test cryostat_deployment.yaml
+templates:
+  - cryostat_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4
+      - equal:
+          path: spec.replicas
+          value: 1
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.3-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate all container settings including environment variables and security contexts
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].image
+          value: "registry.redhat.io/cryostat/cryostat-rhel9:4.0.3"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9:4.0.3"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PORT')].value
+          value: "8181"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_LOG_LEVEL')].value
+          value: "INFO"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_HOST')].value
+          value: "localhost"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HIBERNATE_ORM_DATABASE_GENERATION')].value
+          value: "none"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_HIBERNATE_ORM_SQL_LOAD_SCRIPT')].value
+          value: "no-file"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_DATASOURCE_USERNAME')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_DATASOURCE_PASSWORD')].valueFrom.secretKeyRef
+          value:
+            key: "CONNECTION_KEY"
+            name: "RELEASE-NAME-db"
+            optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_DATASOURCE_JDBC_URL')].value
+          value: "jdbc:postgresql://RELEASE-NAME-cryostat-db:5432/cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='STORAGE_BUCKETS_ARCHIVES_NAME')].value
+          value: "archivedrecordings"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_ENDPOINT_OVERRIDE')].value
+          value: "http://RELEASE-NAME-cryostat-storage:8333"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_PATH_STYLE_ACCESS')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_REGION')].value
+          value: "us-east-1"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_TYPE')].value
+          value: "static"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='AWS_ACCESS_KEY_ID')].value
+          value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID)
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY')].valueFrom.secretKeyRef
+          value:
+              key: "STORAGE_ACCESS_KEY"
+              name: "RELEASE-NAME-storage-secret"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='AWS_SECRET_ACCESS_KEY')].value
+          value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY)
+      - notExists:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_REST_CLIENT_REPORTS_URL')].value
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='GRAFANA_DATASOURCE_URL')].value
+          value: "http://localhost:8800"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='GRAFANA_DASHBOARD_URL')].value
+          value: "http://localhost:3000"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='GRAFANA_DASHBOARD_EXT_URL')].value
+          value: "/grafana/"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_ENABLED')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_NAMESPACES')].value
+          value: "NAMESPACE"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NAMES')].value
+          value: "jfr-jmx"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NUMBERS')].value
+          value: "9091"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].ports[0].containerPort
+          value: 8181
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].livenessProbe.exec.command
+          value:
+            - curl
+            - --fail
+            - http://localhost:8181/health/liveness
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].startupProbe.exec.command
+          value:
+            - curl
+            - --fail
+            - http://localhost:8181/health/liveness
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].startupProbe.failureThreshold
+          value: 18
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].resources
+          value:
+            requests:
+              cpu: 500m
+              memory: 384Mi
+      - notExists:
+          path: spec.template.spec.contains[?(@.name=='cryostat')].volumeMounts
+
+  - it: should set log level
+    set:
+      core:
+        debug:
+          log:
+            level: TRACE
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_LOG_LEVEL')].value
+          value: TRACE
+
+  - it: should set environment variable if sidecar report generator is enabled
+    set:
+      reports:
+        replicas: 1
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_REST_CLIENT_REPORTS_URL')].value
+          value: http://cryostat:$(REPORTS_PASS_SECRET_KEY)@RELEASE-NAME-cryostat-reports.NAMESPACE.svc:10001
+
+  - it: should set environment variable if sidecar report generator is enabled in OpenShift with HTTPS
+    set:
+      reports:
+        replicas: 1
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].env[?(@.name=='QUARKUS_REST_CLIENT_REPORTS_URL')].value
+          value: https://cryostat:$(REPORTS_PASS_SECRET_KEY)@RELEASE-NAME-cryostat-reports.NAMESPACE.svc:10001
+
+  - it: should set oauth2proxy resource overrides
+    set:
+      oauth2Proxy:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set openshiftOauthProxy resource overrides
+    set:
+      authentication:
+        openshift:
+          enabled: true
+      openshiftOauthProxy:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set cryostat resource overrides
+    set:
+      core:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set grafana resource overrides
+    set:
+      grafana:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set jfr-datasource resource overrides
+    set:
+      datasource:
+        resources:
+          limits:
+            cpu: 4000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].resources
+          value:
+            limits:
+              cpu: 4000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should validate cryostat-grafana settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].image
+          value: "registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_AUTH_ANONYMOUS_ENABLED')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_SERVER_DOMAIN')].value
+          value: "localhost"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_SERVER_ROOT_URL')].value
+          value: "http://localhost:4180/grafana/"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='GF_SERVER_SERVE_FROM_SUB_PATH')].value
+          value: "true"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].env[?(@.name=='JFR_DATASOURCE_URL')].value
+          value: "http://localhost:8800"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].ports[0].containerPort
+          value: 3000
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].livenessProbe.httpGet.path
+          value: "/api/health"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].livenessProbe.httpGet.port
+          value: 3000
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].resources
+          value:
+            requests:
+              cpu: 25m
+              memory: 80Mi
+
+  - it: should validate cryostat-jfr-datasource settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].image
+          value: "registry.redhat.io/cryostat/jfr-datasource-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].env[?(@.name=='LISTEN_HOST')].value
+          value: "localhost"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].env[?(@.name=='QUARKUS_HTTP_PORT')].value
+          value: "8800"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].ports[0].containerPort
+          value: 8800
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].livenessProbe.exec.command
+          value:
+              - curl
+              - --fail
+              - http://localhost:8800
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].resources
+          value:
+            requests:
+              cpu: 200m
+              memory: 200Mi
+
+  - it: should validate volumes and volume mounts
+    asserts:
+      - lengthEqual:
+          count: 1
+          path: spec.template.spec.volumes
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='alpha-config')]
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].volumeMounts[?(@.mountPath=='/etc/oauth2_proxy/alpha_config')]
+
+  - it: should validate volumes and volume mounts with oauth2-proxy self-signed TLS enabled
+    set:
+      oauth2Proxy.tls.selfSigned.enabled: true
+    asserts:
+      - lengthEqual:
+          count: 2
+          path: spec.template.spec.volumes
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='alpha-config')]
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].volumeMounts[?(@.mountPath=='/etc/oauth2_proxy/alpha_config')]
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='RELEASE-NAME-oauth2proxy-tls')]
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].volumeMounts[?(@.mountPath=='/etc/tls/private')]
+
+  - it: should set image pull secrets if specified
+    set:
+      imagePullSecrets:
+        - name: myregistrykey
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: "myregistrykey"
+
+  - it: should configure the OpenShift OAuth Proxy when authentication.openshift is enabled
+    set:
+      authentication.openshift.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9:4.0.3"
+
+  - it: should configure the OAuth2 Proxy when OpenShift OAuth is disabled and OAuth2 is enabled
+    set:
+      authentication.openshift.enabled: false
+      authentication.oauth2.enabled: true
+    asserts:
+    - exists:
+        path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')]
+    - equal:
+        path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].image
+        value: ""
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      core.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      nodeSelector:
+        disktype: hdd
+      core.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      core.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      core.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      core.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      core.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      core.image.tag: "4.0.3"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].imagePullPolicy
+          value: IfNotPresent
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].imagePullPolicy
+          value: IfNotPresent
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].imagePullPolicy
+          value: IfNotPresent
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
+          value: IfNotPresent
+
+  - it: should verify image pull policies for release versions
+    set:
+      core.image.tag: "4.1.0"
+      core.image.pullPolicy: "IfNotPresent"
+      oauth2Proxy.image.pullPolicy: "IfNotPresent"
+      grafana.image.pullPolicy: "IfNotPresent"
+      db.image.pullPolicy: "IfNotPresent"
+      datasource.image.pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-authproxy')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-grafana')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should add volume mounts for declarative event templates
+    set:
+      core.config.eventTemplates.configMapNames: ['a', 'b']
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].volumeMounts
+          value:
+            - name: a
+              mountPath: /opt/cryostat.d/templates.d/a
+              readOnly: true
+            - name: b
+              mountPath: /opt/cryostat.d/templates.d/b
+              readOnly: true
+      - equal:
+          path: spec.template.spec.volumes
+          value:
+            - name: alpha-config
+              configMap:
+                name: RELEASE-NAME-alpha-config
+            - name: a
+              configMap:
+                name: a
+            - name: b
+              configMap:
+                name: b
+
+  - it: should add volume mounts for declarative TLS truststore
+    set:
+      core.config.tlsTruststore.secretNames: ['a', 'b']
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat')].volumeMounts
+          value:
+            - name: a
+              mountPath: /truststore/a
+              readOnly: true
+            - name: b
+              mountPath: /truststore/b
+              readOnly: true
+      - equal:
+          path: spec.template.spec.volumes
+          value:
+            - name: alpha-config
+              configMap:
+                name: RELEASE-NAME-alpha-config
+            - name: a
+              secret:
+                secretName: a
+            - name: b
+              secret:
+                secretName: b
+
+  - it: should set default podAnnotations
+    set:
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      core.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      core.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_service_test.yaml
new file mode 100644
index 000000000..665a2dc84
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_service_test.yaml
@@ -0,0 +1,195 @@
+suite: test cryostat_service.yaml
+templates:
+  - cryostat_service.yaml
+
+tests:
+  - it: should create a Service with the correct settings
+    set:
+      core.service.type: ClusterIP
+      core.service.httpPort: 8080
+      authentication.openshift.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - lengthEqual:
+          path: spec.ports
+          count: 1
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 4180
+      - equal:
+          path: spec.ports[0].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[0].appProtocol
+          value: http
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should create a Service with the correct settings when OpenShift authentication is enabled
+    set:
+      authentication.openshift.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - lengthEqual:
+          path: spec.ports
+          count: 2
+      - equal:
+          path: spec.ports[0].port
+          value: 8181
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 4180
+      - equal:
+          path: spec.ports[0].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[1].port
+          value: 443
+      - equal:
+          path: spec.ports[1].targetPort
+          value: 8443
+      - equal:
+          path: spec.ports[1].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[1].name
+          value: https
+      - equal:
+          path: spec.ports[1].appProtocol
+          value: https
+      - equal:
+          path: spec.selector
+          value:
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: cryostat
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: metadata.annotations
+          value:
+            service.alpha.openshift.io/serving-cert-secret-name: RELEASE-NAME-proxy-tls
+
+  - it: should include OpenShift specific annotations when OpenShift auth is enabled
+    set:
+      authentication.openshift.enabled: true
+    asserts:
+      - exists:
+          path: metadata.annotations
+      - equal:
+          path: metadata.annotations
+          value:
+            service.alpha.openshift.io/serving-cert-secret-name: RELEASE-NAME-proxy-tls
+
+  - it: should not include OpenShift specific annotations when OpenShift auth is disabled
+    set:
+      authentication.openshift.enabled: false
+    asserts:
+      - notExists:
+          path: metadata.annotations.`service.alpha.openshift.io/serving-cert-secret-name`
+
+  - it: should create a Service with the correct settings when oauth2-proxy self-signed TLS is enabled
+    set:
+      oauth2Proxy.tls.selfSigned.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - lengthEqual:
+          path: spec.ports
+          count: 2
+      - equal:
+          path: spec.ports[0].port
+          value: 8181
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 4180
+      - equal:
+          path: spec.ports[0].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[1].port
+          value: 443
+      - equal:
+          path: spec.ports[1].targetPort
+          value: 8443
+      - equal:
+          path: spec.ports[1].protocol
+          value: TCP
+      - equal:
+          path: spec.ports[1].name
+          value: https
+      - equal:
+          path: spec.selector
+          value:
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/component: cryostat
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_tls_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_tls_secret_test.yaml
new file mode 100644
index 000000000..f1bd2bdad
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/cryostat_tls_secret_test.yaml
@@ -0,0 +1,46 @@
+suite: test cryostat_tls_secret.yaml
+templates:
+  - cryostat_tls_secret.yaml
+
+tests:
+  - it: should create a TLS cert secret if oauth2Proxy.tls.selfSigned.enabled is set
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-oauth2proxy-tls
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.key
+      - exists:
+          path: data.cert
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: 4.0.3-redhat
+            helm.sh/chart: cryostat-2.0.3
+
+  - it: should not create a TLS cert secret if oauth2Proxy.tls.selfSigned.enabled is not set
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_deployment_test.yaml
new file mode 100644
index 000000000..6962f3110
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_deployment_test.yaml
@@ -0,0 +1,364 @@
+suite: test db_deployment.yaml
+templates:
+  - db_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4-db
+      - equal:
+          path: spec.replicas
+          value: 1
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+      - notExists:
+          path: spec.template.spec.serviceAccountName
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.3-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate cryostat-db settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].image
+          value: "registry.redhat.io/cryostat/cryostat-db-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='POSTGRESQL_USER')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='POSTGRESQL_PASSWORD')].valueFrom.secretKeyRef
+          value:
+              name: "RELEASE-NAME-db"
+              key: "CONNECTION_KEY"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='POSTGRESQL_DATABASE')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].env[?(@.name=='PG_ENCRYPT_KEY')].valueFrom.secretKeyRef
+          value:
+              name: "RELEASE-NAME-db"
+              key: "ENCRYPTION_KEY"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].ports[0].containerPort
+          value: 5432
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[0].mountPath
+          value: "/var/lib/pgsql/data"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[0].name
+          value: "cryostat-db"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[0].subPath
+          value: "postgres"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].readinessProbe.exec.command
+          value:
+              - pg_isready
+              - -U
+              - cryostat
+              - -d
+              - cryostat
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].resources
+          value:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+
+  - it: should set resource overrides
+    set:
+      db:
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].resources
+          value:
+            limits:
+              cpu: 2000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set PersistentVolumeClaim (pvc) reference
+    set:
+      db:
+        pvc:
+          enabled: true
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+          value:
+            name: cryostat-db
+            persistentVolumeClaim:
+              claimName: RELEASE-NAME-db
+
+  - it: should validate volumes and volume mounts
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-db')]
+          value:
+            name: cryostat-db
+            emptyDir: {}
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].volumeMounts[?(@.mountPath=='/var/lib/pgsql/data')]
+
+  - it: should set image pull secrets if specified
+    set:
+      imagePullSecrets:
+        - name: myregistrykey
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: "myregistrykey"
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      db.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      nodeSelector:
+        disktype: hdd
+      db.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      db.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      db.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      db.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      db.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      core.image.tag: "4.0.3-snapshot"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].imagePullPolicy
+          value: "Always"
+
+  - it: should verify image pull policies for release versions
+    set:
+      db.image.pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-db')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should set default podAnnotations
+    set:
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      db.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      db.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_pvc_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_pvc_test.yaml
new file mode 100644
index 000000000..c4353a25f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_pvc_test.yaml
@@ -0,0 +1,57 @@
+suite: test db_pvc.yaml
+templates:
+  - db_pvc.yaml
+
+tests:
+  - it: should create a PersistentVolumeClaim with correct settings
+    set:
+      db.pvc:
+        enabled: true
+        storage: "10Gi"
+        accessModes:
+          - "ReadWriteOnce"
+        storageClassName: "standard"
+        annotations:
+          "volume.beta.kubernetes.io/storage-class": "standard"
+        selector:
+          matchLabels:
+            app: cryostat
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat-db"
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+      - equal:
+          path: spec.accessModes
+          value:
+            - "ReadWriteOnce"
+      - equal:
+          path: spec.resources.requests.storage
+          value: "10Gi"
+      - equal:
+          path: spec.storageClassName
+          value: "standard"
+      - equal:
+          path: spec.selector.matchLabels.app
+          value: "cryostat"
+
+  - it: should not create a PersistentVolumeClaim when PVC is disabled
+    set:
+      db.pvc:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_secret_test.yaml
new file mode 100644
index 000000000..694dfd1a9
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_secret_test.yaml
@@ -0,0 +1,40 @@
+suite: test db_secret.yaml
+templates:
+  - db_secret.yaml
+
+tests:
+  - it: should create a database secret if core.databaseSecretName is not set
+    set:
+      core.databaseSecretName: ""
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-db
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.ENCRYPTION_KEY
+      - exists:
+          path: data.CONNECTION_KEY
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.3-redhat
+            helm.sh/chart: cryostat-2.0.3
+
+  - it: should not create a database secret if core.databaseSecretName is set
+    set:
+      core.databaseSecretName: "custom-db-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_service_test.yaml
new file mode 100644
index 000000000..d7c359753
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/db_service_test.yaml
@@ -0,0 +1,61 @@
+suite: test db_service.yaml
+templates:
+  - db_service.yaml
+
+tests:
+  - it: should create a Service with the correct default settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-db
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 5432
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should create a Service with the correct settings overrides
+    set:
+      db.service.type: NodeIP
+      db.service.port: 8080
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-db
+      - equal:
+          path: spec.type
+          value: NodeIP
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: db
+            app.kubernetes.io/part-of: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/ingress_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/ingress_test.yaml
new file mode 100644
index 000000000..f822dd159
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/ingress_test.yaml
@@ -0,0 +1,60 @@
+suite: test ingress.yaml
+templates:
+  - ingress.yaml
+
+tests:
+  - it: should create an Ingress with default settings
+    set:
+      core.ingress.enabled: true
+      core.service.httpPort: 8080
+      core:
+        ingress:
+          className: nginx
+          annotations:
+            nginx.ingress.kubernetes.io/rewrite-target: /
+          hosts:
+            - host: example.com
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - hosts:
+                - example.com
+              secretName: example-tls
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Ingress
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+      - equal:
+          path: metadata.annotations['nginx.ingress.kubernetes.io/rewrite-target']
+          value:  "/"
+      - equal:
+          path: spec.rules[0].host
+          value: "example.com"
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: "/"
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.port.number
+          value: 8080
+      - equal:
+          path: spec.ingressClassName
+          value: "nginx"
+      - equal:
+          path: spec.tls[0].secretName
+          value: "example-tls"
+
+  - it: should not create an Ingress when ingress is disabled
+    set:
+      core.ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/networkpolicy_ingress_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/networkpolicy_ingress_test.yaml
new file mode 100644
index 000000000..22c7a2bf6
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/networkpolicy_ingress_test.yaml
@@ -0,0 +1,148 @@
+suite: test networkpolicy_ingress.yaml
+templates:
+  - networkpolicy_ingress.yaml
+
+tests:
+  - it: should do nothing if disabled
+    set:
+      networkPolicy.ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create policy objects
+    asserts:
+      - hasDocuments:
+          count: 4
+
+  - it: should create a Cryostat access policy
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: cryostat
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector: {}
+              ports:
+                - protocol: TCP
+                  port: 4180
+                - protocol: TCP
+                  port: 8443
+
+  - it: should create a report generator access policy
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-reports-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: reports
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: NAMESPACE
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/component: cryostat
+                    app.kubernetes.io/instance: RELEASE-NAME
+                    app.kubernetes.io/name: cryostat
+                    app.kubernetes.io/part-of: cryostat
+              ports:
+                - protocol: TCP
+                  port: 4180
+                - protocol: TCP
+                  port: 8443
+
+  - it: should create a database access policy
+    documentIndex: 2
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-db-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: db
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: NAMESPACE
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/component: cryostat
+                    app.kubernetes.io/instance: RELEASE-NAME
+                    app.kubernetes.io/name: cryostat
+                    app.kubernetes.io/part-of: cryostat
+              ports:
+                - protocol: TCP
+                  port: 5432
+
+  - it: should create a storage access policy
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: kind
+          value: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-storage-internal-ingress
+      - equal:
+          path: spec.podSelector
+          value:
+            matchLabels:
+              app.kubernetes.io/instance: RELEASE-NAME
+              app.kubernetes.io/name: cryostat
+              app.kubernetes.io/part-of: cryostat
+              app.kubernetes.io/component: storage
+      - equal:
+          path: spec.ingress
+          value:
+            - from:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: NAMESPACE
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/component: cryostat
+                    app.kubernetes.io/instance: RELEASE-NAME
+                    app.kubernetes.io/name: cryostat
+                    app.kubernetes.io/part-of: cryostat
+              ports:
+                - protocol: TCP
+                  port: 8333
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/notes_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/notes_test.yaml
new file mode 100644
index 000000000..dfaf5259f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/notes_test.yaml
@@ -0,0 +1,164 @@
+suite: test NOTES.txt
+templates:
+  - NOTES.txt
+
+tests:
+  - it: should render correct notes for enabled ingress
+    set:
+      core.ingress.enabled: true
+      core:
+        ingress:
+          className: nginx
+          hosts:
+            - host: example.com
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - hosts:
+                - example.com
+              secretName: example-tls
+    asserts:
+      - equalRaw:
+          value: |
+
+
+            1. Visit the application at:
+              ```
+              https://example.com/
+              ```
+
+  - it: should render correct notes for enabled route without TLS
+    set:
+      core.route.enabled: true
+      core.route.tls.enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Visit the application at:
+              ```
+              echo http://$(oc get route -n NAMESPACE RELEASE-NAME-cryostat -o jsonpath="{.status.ingress[0].host}")
+              ```
+
+  - it: should render correct notes for enabled route with TLS
+    set:
+      core.route.enabled: true
+      core.route.tls.enabled: true
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Visit the application at:
+              ```
+              echo https://$(oc get route -n NAMESPACE RELEASE-NAME-cryostat -o jsonpath="{.status.ingress[0].host}")
+              ```
+
+  - it: should render correct notes for NodePort service without ingress or route
+    set:
+      core.service.type: "NodePort"
+      core.ingress.enabled: false
+      core.route.enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              export NODE_IP=$(kubectl get nodes -n NAMESPACE -o jsonpath="{.items[0].status.addresses[0].address}")
+              export NODE_PORT=$(kubectl get -n NAMESPACE -o jsonpath="{.spec.ports[0].nodePort}" services RELEASE-NAME-cryostat)
+              kubectl -n NAMESPACE set env deploy --containers=cryostat RELEASE-NAME-cryostat-v4 QUARKUS_HTTP_HOST=$NODE_IP
+              ```
+
+            2. Visit the application at:
+              ```
+              echo http://$NODE_IP:$NODE_PORT
+              ```
+
+  - it: should render correct notes for LoadBalancer service without ingress or route
+    set:
+      core.service.type: "LoadBalancer"
+      core.ingress.enabled: false
+      core.route.enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+                 NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+                       You can watch the status by running 'kubectl get -n NAMESPACE -w svc/RELEASE-NAME-cryostat'
+              export SERVICE_IP=$(kubectl get svc -n NAMESPACE RELEASE-NAME-cryostat --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
+              kubectl -n NAMESPACE set env deploy --containers=cryostat RELEASE-NAME-cryostat-v4 QUARKUS_HTTP_HOST=$SERVICE_IP
+              ```
+
+            2. Visit the application at:
+              ```
+              echo http://$SERVICE_IP:8181
+              ```
+
+  - it: should render correct notes for ClusterIP service without ingress or route and TLS enabled
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: true
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Forward local port to the application's service:
+              ```
+              kubectl -n NAMESPACE wait --for=condition=available --timeout=60s deploy/RELEASE-NAME-cryostat-v4
+
+              export SVC_NAME=$(kubectl get services -n NAMESPACE -l "app.kubernetes.io/name=cryostat,app.kubernetes.io/instance=RELEASE-NAME,app.kubernetes.io/component=cryostat" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
+              kubectl -n NAMESPACE port-forward svc/$SVC_NAME 8443:https
+              ```
+
+            3. Visit the application at:
+              ```
+              https://localhost:8443
+              ```
+
+  - it: should render correct notes for ClusterIP service without ingress or route and TLS disabled
+    set:
+      oauth2Proxy:
+        tls:
+          selfSigned:
+            enabled: false
+    asserts:
+      - equalRaw:
+          value: |
+
+            1. Configure the application to serve external traffic:
+              ```
+              No actions required with this configuration.
+              ```
+
+            2. Forward local port to the application's service:
+              ```
+              kubectl -n NAMESPACE wait --for=condition=available --timeout=60s deploy/RELEASE-NAME-cryostat-v4
+
+              export SVC_NAME=$(kubectl get services -n NAMESPACE -l "app.kubernetes.io/name=cryostat,app.kubernetes.io/instance=RELEASE-NAME,app.kubernetes.io/component=cryostat" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
+              kubectl -n NAMESPACE port-forward svc/$SVC_NAME 8080:http
+              ```
+
+            3. Visit the application at:
+              ```
+              http://localhost:8080
+              ```
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_deployment_test.yaml
new file mode 100644
index 000000000..d88ff8ac9
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_deployment_test.yaml
@@ -0,0 +1,316 @@
+suite: test reports_deployment.yaml
+templates:
+  - reports_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings when disabled
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should verify general deployment settings when enabled
+    set:
+      reports:
+        replicas: 2
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4-reports
+      - equal:
+          path: spec.replicas
+          value: 2
+      - equal:
+          path: spec.strategy.type
+          value: RollingUpdate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: reports
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/component: reports
+      - notExists:
+          path: spec.template.spec.serviceAccountName
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.3-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: reports
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate all container settings including environment variables and security contexts
+    set:
+      reports:
+        replicas: 1
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].ports
+          value:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].image
+          value: "registry.redhat.io/cryostat/cryostat-reports-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].env[?(@.name=='QUARKUS_HTTP_PORT')].value
+          value: "10001"
+
+  - it: should validate authproxy settings when deployed in OpenShift
+    set:
+      reports:
+        replicas: 1
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].image
+          value: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports-authproxy')].ports
+          value:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+            - containerPort: 8443
+              name: https
+              protocol: TCP
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      reports:
+        replicas: 1
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      reports.replicas: 1
+      reports.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      reports.replicas: 1
+      nodeSelector:
+        disktype: hdd
+      reports.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      reports.replicas: 1
+      reports.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      reports.replicas: 1
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      reports.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      reports.replicas: 1
+      reports.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      reports.replicas: 1
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      reports.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      reports:
+        replicas: 1
+        image:
+          tag: "4.0.3-snapshot"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].imagePullPolicy
+          value: "Always"
+
+  - it: should verify image pull policies for release versions
+    set:
+      reports:
+        replicas: 1
+        image:
+          tag: "4.1.0"
+          pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-reports')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should set default podAnnotations
+    set:
+      reports.replicas: 1
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      reports.replicas: 1
+      reports.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      reports.replicas: 1
+      reports.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_secret_test.yaml
new file mode 100644
index 000000000..e9c1a3f09
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_secret_test.yaml
@@ -0,0 +1,40 @@
+suite: test reports_secret.yaml
+templates:
+  - reports_secret.yaml
+
+tests:
+  - it: should create a reports secret if core.reportsSecretName is not set
+    set:
+      core.reportsSecretName: ""
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-reports-secret
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.htpasswd
+      - exists:
+          path: data.REPORTS_PASS
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: 4.0.3-redhat
+            helm.sh/chart: cryostat-2.0.3
+
+  - it: should not create a database secret if reports.reportsSecretName is set
+    set:
+      reports.reportsSecretName: "custom-reports-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_service_test.yaml
new file mode 100644
index 000000000..f2feba1b0
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/reports_service_test.yaml
@@ -0,0 +1,78 @@
+suite: test reports_service.yaml
+templates:
+  - reports_service.yaml
+
+tests:
+  - it: should do nothing if report generators are not desired
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create a Service targeting the Pod http port
+    set:
+      reports:
+        replicas: 1
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-reports
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 10001
+      - equal:
+          path: spec.ports[0].targetPort
+          value: http
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: reports
+
+  - it: should create a Service targeting the Pod https port when deployed in OpenShift
+    set:
+      reports:
+        replicas: 1
+      authentication:
+        openshift:
+          enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-reports
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 10001
+      - equal:
+          path: spec.ports[0].targetPort
+          value: https
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: reports
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/role_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/role_test.yaml
new file mode 100644
index 000000000..ebf14d081
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/role_test.yaml
@@ -0,0 +1,143 @@
+suite: test role.yaml
+templates:
+  - role.yaml
+
+tests:
+  - it: should create Roles in target namespace
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces:
+        - "default"
+        - "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 2
+      - equal:
+          path: kind
+          value: Role
+      - equal:
+          path: metadata.namespace
+          value: "default"
+        documentIndex: 0
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        documentIndex: 1
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+        documentIndex: 0
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+        documentIndex: 1
+
+  - it: should have correct permissions for endpoints, pods, and other resources
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces:
+        - "default"
+    asserts:
+      - equal:
+          path: rules[0].apiGroups
+          value: [""]
+      - equal:
+          path: rules[0].resources
+          value: ["endpoints"]
+      - equal:
+          path: rules[0].verbs
+          value: ["get", "list", "watch"]
+      - equal:
+          path: rules[1].apiGroups
+          value: [""]
+      - equal:
+          path: rules[1].resources
+          value: ["pods", "replicationcontrollers"]
+      - equal:
+          path: rules[1].verbs
+          value: ["get"]
+      - equal:
+          path: rules[2].apiGroups
+          value: ["apps"]
+      - equal:
+          path: rules[2].resources
+          value: ["replicasets", "deployments", "daemonsets", "statefulsets"]
+      - equal:
+          path: rules[2].verbs
+          value: ["get"]
+      - equal:
+          path: rules[3].apiGroups
+          value: ["apps.openshift.io"]
+      - equal:
+          path: rules[3].resources
+          value: ["deploymentconfigs"]
+      - equal:
+          path: rules[3].verbs
+          value: ["get"]
+      - equal:
+          path: rules[4].apiGroups
+          value: ["route.openshift.io"]
+      - equal:
+          path: rules[4].verbs
+          value: ["get", "list"]
+      - equal:
+          path: rules[4].resources
+          value: ["routes"]
+
+  - it: should not create any Role if RBAC is disabled
+    set:
+      rbac.create: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create any Roles when Kubernetes discovery is disabled
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not specify a namespace if installNamespaceDisabled is true
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.installNamespaceDisabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should specify the default namespace if installNamespaceDisabled is false
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.installNamespaceDisabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.namespace
+          value: "NAMESPACE"
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/rolebinding_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/rolebinding_test.yaml
new file mode 100644
index 000000000..05d368453
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/rolebinding_test.yaml
@@ -0,0 +1,124 @@
+suite: test rolebinding.yaml
+templates:
+  - rolebinding.yaml
+
+tests:
+  - it: should create a RoleBinding in the default namespace
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces:
+        - "default"
+        - "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 2
+      - equal:
+          path: kind
+          value: RoleBinding
+        documentIndex: 0
+      - equal:
+          path: kind
+          value: RoleBinding
+        documentIndex: 1
+      - equal:
+          path: metadata.namespace
+          value: "default"
+        documentIndex: 0
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        documentIndex: 1
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: metadata.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: roleRef.apiGroup
+          value: "rbac.authorization.k8s.io"
+        documentIndex: 0
+      - equal:
+          path: roleRef.apiGroup
+          value: "rbac.authorization.k8s.io"
+        documentIndex: 1
+      - equal:
+          path: roleRef.kind
+          value: "Role"
+        documentIndex: 0
+      - equal:
+          path: roleRef.kind
+          value: "Role"
+        documentIndex: 1
+      - matchRegex:
+          path: roleRef.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: roleRef.name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: subjects[0].kind
+          value: "ServiceAccount"
+        documentIndex: 0
+      - equal:
+          path: subjects[0].kind
+          value: "ServiceAccount"
+        documentIndex: 1
+      - matchRegex:
+          path: subjects[0].name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 0
+      - matchRegex:
+          path: subjects[0].name
+          pattern: "RELEASE-NAME-cryostat"
+        documentIndex: 1
+      - equal:
+          path: subjects[0].namespace
+          value: "NAMESPACE"
+        documentIndex: 0
+      - equal:
+          path: subjects[0].namespace
+          value: "NAMESPACE"
+        documentIndex: 1
+
+  - it: should not create any RoleBinding if RBAC is disabled
+    set:
+      rbac.create: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create any RoleBinding when Kubernetes discovery is disabled
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: false
+    asserts:
+    - hasDocuments:
+        count: 0
+
+  - it: should not create any RoleBinding if installNamespaceDisabled is true
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.installNamespaceDisabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create a RoleBinding in the default namespace if installNamespaceDisabled is false
+    set:
+      rbac.create: true
+      core.discovery.kubernetes.enabled: true
+      core.discovery.kubernetes.namespaces: []
+      core.discovery.kubernetes.installNamespaceDisabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.namespace
+          value: "NAMESPACE"
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/route_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/route_test.yaml
new file mode 100644
index 000000000..f13e92a1f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/route_test.yaml
@@ -0,0 +1,75 @@
+suite: test route.yaml
+templates:
+  - route.yaml
+
+tests:
+  - it: should create a Route when routing is enabled
+    set:
+      core.route.enabled: true
+      core:
+        route:
+          annotations:
+            hello: world
+          tls:
+            enabled: true
+            termination: edge
+            insecureEdgeTerminationPolicy: Redirect
+            key: "RSA PRIVATE KEY"
+            destinationCACertificate: "DESTINATION CA"
+            caCertificate: "CA CERT"
+            certificate: "CERT"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Route
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+      - equal:
+          path: metadata.annotations.hello
+          value: "world"
+      - equal:
+          path: spec.to.kind
+          value: "Service"
+      - equal:
+          path: spec.to.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: spec.port.targetPort
+          value: 4180
+      - equal:
+          path: spec.tls.termination
+          value: "edge"
+      - equal:
+          path: spec.tls.insecureEdgeTerminationPolicy
+          value: "Redirect"
+      - matchRegex:
+          path: spec.tls.key
+          pattern: ".*RSA PRIVATE KEY.*"
+      - matchRegex:
+          path: spec.tls.destinationCACertificate
+          pattern: ".*DESTINATION CA.*"
+      - matchRegex:
+          path: spec.tls.caCertificate
+          pattern: ".*CA CERT.*"
+      - matchRegex:
+          path: spec.tls.certificate
+          pattern: ".*CERT.*"
+
+  - it: should not create a Route when routing is disabled
+    set:
+      core.route.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/serviceaccount_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/serviceaccount_test.yaml
new file mode 100644
index 000000000..211aa9b37
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/serviceaccount_test.yaml
@@ -0,0 +1,37 @@
+suite: test serviceaccount.yaml
+templates:
+  - serviceaccount.yaml
+
+tests:
+  - it: should create a ServiceAccount with OpenShift redirect annotations when OpenShift auth is enabled
+    set:
+      authentication.openshift.enabled: true
+      serviceAccount.create: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: ServiceAccount
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat"
+      - equal:
+          path: metadata.annotations
+          value:
+            serviceaccounts.openshift.io/oauth-redirectreference.primary: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"RELEASE-NAME-cryostat"}}'
+
+  - it: should not include OpenShift specific annotations when OpenShift auth is disabled
+    set:
+      authentication.openshift.enabled: false
+      serviceAccount.create: true
+    asserts:
+      - notExists:
+          path: metadata.annotations
+
+  - it: should not create a ServiceAccount when serviceAccount.create is disabled
+    set:
+      serviceAccount.create: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_deployment_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_deployment_test.yaml
new file mode 100644
index 000000000..02c0d52e3
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_deployment_test.yaml
@@ -0,0 +1,393 @@
+suite: test storage_deployment.yaml
+templates:
+  - storage_deployment.yaml
+
+tests:
+  - it: should verify general deployment settings
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-v4-storage
+      - equal:
+          path: spec.replicas
+          value: 1
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+      - equal:
+          path: spec.template.metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+      - notExists:
+          path: spec.template.spec.serviceAccountName
+      - equal:
+          path: spec.template.spec.securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.securityContext.seccompProfile.type
+          value: RuntimeDefault
+      - equal:
+          path: metadata.labels
+          value:
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/version: "4.0.3-redhat"
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should validate cryostat-storage settings
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')]
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].securityContext.capabilities.drop
+          value:
+            - ALL
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].image
+          value: "registry.redhat.io/cryostat/cryostat-storage-rhel9"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].imagePullPolicy
+          value: "IfNotPresent"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_BUCKETS')].value
+          value: "archivedrecordings,archivedreports,eventtemplates,probes"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_ACCESS_KEY')].value
+          value: "cryostat"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='CRYOSTAT_SECRET_KEY')].valueFrom.secretKeyRef
+          value:
+              name: "RELEASE-NAME-storage-secret"
+              key: "STORAGE_ACCESS_KEY"
+              optional: false
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='DATA_DIR')].value
+          value: "/data"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='IP_BIND')].value
+          value: 0.0.0.0
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='REST_ENCRYPTION_ENABLE')].value
+          value: "1"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].ports[0].containerPort
+          value: 8333
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].ports[0].protocol
+          value: "TCP"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[0].mountPath
+          value: "/data"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[0].name
+          value: "cryostat-storage"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[0].subPath
+          value: "seaweed"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.httpGet.path
+          value: "/status"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.httpGet.port
+          value: 8333
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.periodSeconds
+          value: 10
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].livenessProbe.failureThreshold
+          value: 2
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.httpGet.path
+          value: "/status"
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.httpGet.port
+          value: 8333
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.periodSeconds
+          value: 10
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].startupProbe.failureThreshold
+          value: 9
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].resources
+          value:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+
+  - it: should allow disabling at-rest encryption
+    set:
+      storage:
+        encryption:
+          enabled: false
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].env[?(@.name=='REST_ENCRYPTION_ENABLE')].value
+          value: "0"
+
+  - it: should set resource overrides
+    set:
+      storage:
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 1Gi
+          requests:
+            cpu: 4000m
+            memory: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].resources
+          value:
+            limits:
+              cpu: 2000m
+              memory: 1Gi
+            requests:
+              cpu: 4000m
+              memory: 2Gi
+
+  - it: should set PersistentVolumeClaim (pvc) reference
+    set:
+      storage:
+        pvc:
+          enabled: true
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+          value:
+            name: cryostat-storage
+            persistentVolumeClaim:
+              claimName: RELEASE-NAME-storage
+
+  - it: should validate volumes and volume mounts
+    asserts:
+      - exists:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+      - equal:
+          path: spec.template.spec.volumes[?(@.name=='cryostat-storage')]
+          value:
+            name: cryostat-storage
+            emptyDir: {}
+      - exists:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].volumeMounts[?(@.mountPath=='/data')]
+
+  - it: should set image pull secrets if specified
+    set:
+      imagePullSecrets:
+        - name: myregistrykey
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: "myregistrykey"
+
+  - it: should apply Kubernetes specific settings when configured
+    set:
+      nodeSelector:
+        disktype: ssd
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      tolerations:
+      - key: "key"
+        operator: "Equal"
+        value: "value"
+        effect: "NoSchedule"
+    asserts:
+      - exists:
+          path: spec.template.spec.nodeSelector
+      - exists:
+          path: spec.template.spec.affinity
+      - exists:
+          path: spec.template.spec.tolerations
+
+  - it: should accept specific nodeSelector setting
+    set:
+      storage.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should prefer specific nodeSelector over general
+    set:
+      nodeSelector:
+        disktype: hdd
+      storage.nodeSelector:
+        diskType: ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            diskType: ssd
+
+  - it: should accept specific tolerations setting
+    set:
+      storage.tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key1"
+              operator: "Equal"
+              value: "value1"
+              effect: "NoSchedule"
+
+  - it: should prefer specific tolerations over general
+    set:
+      tolerations:
+        - key: "key1"
+          operator: "Equal"
+          value: "value1"
+          effect: "NoSchedule"
+      storage.tolerations:
+        - key: "key2"
+          operator: "Equal"
+          value: "value2"
+          effect: "NoSchedule"
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: "key2"
+              operator: "Equal"
+              value: "value2"
+              effect: "NoSchedule"
+
+  - it: should accept specific affinity setting
+    set:
+      storage.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should prefer specific affinity over general
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+      storage.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: disktype
+                operator: In
+                values:
+                - ssd
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: disktype
+                    operator: In
+                    values:
+                    - ssd
+
+  - it: should verify image pull policies for development snapshots
+    set:
+      core.image.tag: "4.0.3-snapshot"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].imagePullPolicy
+          value: "Always"
+
+  - it: should verify image pull policies for release versions
+    set:
+      storage.image.pullPolicy: "IfNotPresent"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name=='cryostat-storage')].imagePullPolicy
+          value: "IfNotPresent"
+
+  - it: should set default podAnnotations
+    set:
+      podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set pod-specific podAnnotations
+    set:
+      storage.podAnnotations:
+        foo: bar
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            foo: bar
+
+  - it: should set merge pod-specific and default podAnnotations
+    set:
+      storage.podAnnotations:
+        foo: bar
+      podAnnotations:
+        alice: bob
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            alice: bob
+            foo: bar
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_pvc_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_pvc_test.yaml
new file mode 100644
index 000000000..b662f1662
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_pvc_test.yaml
@@ -0,0 +1,57 @@
+suite: test storage_pvc.yaml
+templates:
+  - storage_pvc.yaml
+
+tests:
+  - it: should create a PersistentVolumeClaim with correct settings
+    set:
+      storage.pvc:
+        enabled: true
+        storage: "10Gi"
+        accessModes:
+          - "ReadWriteOnce"
+        storageClassName: "standard"
+        annotations:
+          "volume.beta.kubernetes.io/storage-class": "standard"
+        selector:
+          matchLabels:
+            app: cryostat
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-cryostat-storage"
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+      - equal:
+          path: spec.accessModes
+          value:
+            - "ReadWriteOnce"
+      - equal:
+          path: spec.resources.requests.storage
+          value: "10Gi"
+      - equal:
+          path: spec.storageClassName
+          value: "standard"
+      - equal:
+          path: spec.selector.matchLabels.app
+          value: "cryostat"
+
+  - it: should not create a PersistentVolumeClaim when PVC is disabled
+    set:
+      storage.pvc:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_secret_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_secret_test.yaml
new file mode 100644
index 000000000..692291892
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_secret_test.yaml
@@ -0,0 +1,36 @@
+suite: test storage_secret.yaml
+templates:
+  - storage_secret.yaml
+
+tests:
+  - it: should create a Storage Access Secret with correct settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Secret
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-storage-secret
+      - equal:
+          path: type
+          value: Opaque
+      - exists:
+          path: data.STORAGE_ACCESS_KEY
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/part-of: cryostat
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: 4.0.3-redhat
+            helm.sh/chart: cryostat-2.0.3
+
+  - it: should not create a storage secret if storage.storageSecretName is set
+    set:
+      storage.storageSecretName: "custom-storage-secret"
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_service_test.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_service_test.yaml
new file mode 100644
index 000000000..714e0c3c1
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/tests/storage_service_test.yaml
@@ -0,0 +1,62 @@
+suite: test storage_service.yaml
+templates:
+  - storage_service.yaml
+
+tests:
+  - it: should create a Service with the correct default settings
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-storage
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 8333
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
+
+  - it: should create a Service with the correct settings overrides
+    set:
+      storage.service.type: NodeIP
+      storage.service.port: 8080
+      authentication.openshift.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Service
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cryostat-storage
+      - equal:
+          path: spec.type
+          value: NodeIP
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: cryostat
+            app.kubernetes.io/version: "4.0.3-redhat"
+            helm.sh/chart: cryostat-2.0.3
+            app.kubernetes.io/component: storage
+            app.kubernetes.io/part-of: cryostat
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/values.schema.json b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/values.schema.json
new file mode 100644
index 000000000..f6912d9b1
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/values.schema.json
@@ -0,0 +1,1160 @@
+{
+    "title": "Chart Values",
+    "type": "object",
+    "properties": {
+        "core": {
+            "type": "object",
+            "properties": {
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the main Cryostat container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the main Cryostat container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the main Cryostat container image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the Cryostat application",
+                            "default": "ClusterIP"
+                        },
+                        "httpPort": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service for Cryostat's HTTP server",
+                            "default": 8181
+                        }
+                    }
+                },
+                "debug": {
+                    "type": "object",
+                    "properties": {
+                        "log": {
+                            "type": "object",
+                            "properties": {
+                                "level": {
+                                    "type": "string",
+                                    "description": "Log level for troubleshooting and debugging",
+                                    "default": "INFO"
+                                }
+                            }
+                        }
+                    }
+                },
+                "sslProxied": {
+                    "type": "boolean",
+                    "description": "Enables SSL Proxied Environment Variables, useful when you are offloading SSL/TLS at External Loadbalancer instead of Ingress",
+                    "default": false
+                },
+                "ingress": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether to create an Ingress object for the Cryostat service",
+                            "default": false
+                        },
+                        "className": {
+                            "type": "string",
+                            "description": "Ingress class name for the Cryostat application Ingress",
+                            "default": ""
+                        },
+                        "hosts": {
+                            "type": "array",
+                            "description": "",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "host": {
+                                        "type": "string",
+                                        "description": ""
+                                    },
+                                    "paths": {
+                                        "type": "array",
+                                        "description": "",
+                                        "items": {
+                                            "type": "object",
+                                            "properties": {
+                                                "path": {
+                                                    "type": "string",
+                                                    "description": ""
+                                                },
+                                                "pathType": {
+                                                    "type": "string",
+                                                    "description": ""
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        },
+                        "tls": {
+                            "type": "array",
+                            "description": "TLS configuration for the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)",
+                            "default": [],
+                            "items": {}
+                        }
+                    }
+                },
+                "route": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether to create a Route object for the Cryostat service. Available only on OpenShift",
+                            "default": true
+                        },
+                        "tls": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Whether to secure the Cryostat application Route with TLS. See: [TLSConfig](https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/route-route-openshift-io-v1.html#spec-tls)",
+                                    "default": true
+                                },
+                                "termination": {
+                                    "type": "string",
+                                    "description": "Type of TLS termination to use for the Cryostat application Route. One of: `edge`, `passthrough`, `reencrypt`",
+                                    "default": "edge"
+                                },
+                                "insecureEdgeTerminationPolicy": {
+                                    "type": "string",
+                                    "description": "Specify how to handle insecure traffic for the Cryostat application Route. One of: `Allow`, `Disable`, `Redirect`",
+                                    "default": "Redirect"
+                                },
+                                "key": {
+                                    "type": "string",
+                                    "description": "Custom private key to use when securing the Cryostat application Route",
+                                    "default": ""
+                                },
+                                "certificate": {
+                                    "type": "string",
+                                    "description": "Custom certificate to use when securing the Cryostat application Route",
+                                    "default": ""
+                                },
+                                "caCertificate": {
+                                    "type": "string",
+                                    "description": "Custom CA certificate to use, if needed to complete the certificate chain, when securing the Cryostat application Route",
+                                    "default": ""
+                                },
+                                "destinationCACertificate": {
+                                    "type": "string",
+                                    "description": "Provides the contents of the CA certificate of the final destination when using reencrypt termination for the Cryostat application Route",
+                                    "default": ""
+                                }
+                            }
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "500m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the Cryostat container.",
+                                    "default": "384Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "databaseSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data stored within the database, such as the target credentials keyring. It must not be updated across chart upgrades. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "discovery": {
+                    "type": "object",
+                    "properties": {
+                        "kubernetes": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Enables Kubernetes API discovery mechanism",
+                                    "default": true
+                                },
+                                "installNamespaceDisabled": {
+                                    "type": "boolean",
+                                    "description": "When false and `namespaces` is empty, the Cryostat application will default to discovery targets in the install namespace (i.e. `{{ .Release.Namespace }}`)",
+                                    "default": false
+                                },
+                                "namespaces": {
+                                    "type": "array",
+                                    "description": "List of namespaces whose workloads the Cryostat application should be permitted to access and profile",
+                                    "default": [],
+                                    "items": {}
+                                },
+                                "builtInPortNamesDisabled": {
+                                    "type": "boolean",
+                                    "description": "When false and `portNames` is empty, the Cryostat application will use the default port name `jfr-jmx` to look for JMX connectable targets.",
+                                    "default": false
+                                },
+                                "portNames": {
+                                    "type": "array",
+                                    "description": "List of port names that the Cryostat application should look for in order to consider a target as JMX connectable",
+                                    "default": [],
+                                    "items": {}
+                                },
+                                "builtInPortNumbersDisabled": {
+                                    "type": "boolean",
+                                    "description": "When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.",
+                                    "default": false
+                                },
+                                "portNumbers": {
+                                    "type": "array",
+                                    "description": "List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        }
+                    }
+                },
+                "config": {
+                    "type": "object",
+                    "properties": {
+                        "eventTemplates": {
+                            "type": "object",
+                            "properties": {
+                                "configMapNames": {
+                                    "type": "array",
+                                    "description": "List of ConfigMap names. Each ConfigMap is expected to contain one or more files, which are .jfc (XML) JFR Event Templates, to be mounted to the Cryostat container.",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        },
+                        "tlsTruststore": {
+                            "type": "object",
+                            "properties": {
+                                "secretNames": {
+                                    "type": "array",
+                                    "description": "List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Cryostat Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "reports": {
+            "type": "object",
+            "properties": {
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the Report Generator container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-reports-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the Report Generator container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the Report Generator image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the Report Generator Deployment",
+                            "default": "ClusterIP"
+                        },
+                        "httpPort": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service for the Report Generator Deployment",
+                            "default": 10001
+                        }
+                    }
+                },
+                "reportsSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the report generator access keys. This secret must contain a REPORTS_PASS secret which is the secret credential for the report generators. It must not be updated across chart upgrades, or else the connection between Cryostat and report generators will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "debug": {
+                    "type": "object",
+                    "properties": {
+                        "log": {
+                            "type": "object",
+                            "properties": {
+                                "level": {
+                                    "type": "string",
+                                    "description": "Log level for troubleshooting and debugging",
+                                    "default": "INFO"
+                                }
+                            }
+                        }
+                    }
+                },
+                "replicas": {
+                    "type": "number",
+                    "description": "Number of Report Generator replicas to deploy. If zero, the Deployment and Service will not be created and the main Cryostat container will handle all report generations on its own.",
+                    "default": 0
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for each Pod in the Report Generator Deployment.",
+                                    "default": "500m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for each Pod in the Report Generator Deployment.",
+                                    "default": "512Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Report Generator Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "db": {
+            "type": "object",
+            "properties": {
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the database container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-db-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the database container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the database container image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the database",
+                            "default": "ClusterIP"
+                        },
+                        "port": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service",
+                            "default": 5432
+                        }
+                    }
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the database container.",
+                                    "default": "64Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "pvc": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.",
+                            "default": false
+                        },
+                        "storage": {
+                            "type": "string",
+                            "description": "Storage size to request for the persistentVolumeClaim",
+                            "default": "500Mi"
+                        },
+                        "accessModes": {
+                            "type": "array",
+                            "description": "Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)",
+                            "default": [
+                                "ReadWriteOnce"
+                            ],
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Database Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "storage": {
+            "type": "object",
+            "properties": {
+                "storageSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the storage container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-storage-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the storage container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the storage container image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "encryption": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enable at-rest encryption of stored objects. The storage container will generate a secret key for each stored object and use this key to encrypt and decrypt objects transparently. The key is written to the object metadata, so in the default storage container configuration this only adds a small layer of additional security.",
+                            "default": true
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for the object storage",
+                            "default": "ClusterIP"
+                        },
+                        "port": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service",
+                            "default": 8333
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "50m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the object storage container.",
+                                    "default": "256Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "pvc": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.",
+                            "default": false
+                        },
+                        "storage": {
+                            "type": "string",
+                            "description": "Storage size to request for the persistentVolumeClaim",
+                            "default": "500Mi"
+                        },
+                        "accessModes": {
+                            "type": "array",
+                            "description": "Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)",
+                            "default": [
+                                "ReadWriteOnce"
+                            ],
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Storage Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "grafana": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the Grafana container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the Grafana container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the Grafana container image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "Type of Service to create for Grafana",
+                            "default": "ClusterIP"
+                        },
+                        "port": {
+                            "type": "number",
+                            "description": "Port number to expose on the Service for Grafana's HTTP server",
+                            "default": 3000
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the Grafana container.",
+                                    "default": "80Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the Grafana Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "datasource": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the JFR Data Source container image",
+                            "default": "registry.redhat.io/cryostat/jfr-datasource-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the JFR Data Source container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the JFR Data Source container image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)",
+                                    "default": "200m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the JFR Data Source container.",
+                                    "default": "200Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "tolerations": {
+                    "type": "array",
+                    "description": "Tolerations for the JFR Datasource Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+                    "default": [],
+                    "items": {}
+                }
+            }
+        },
+        "oauth2Proxy": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the OAuth2 Proxy container image",
+                            "default": ""
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the OAuth2 Proxy container image",
+                            "default": "Never"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the OAuth2 Proxy container image",
+                            "default": ""
+                        }
+                    }
+                },
+                "tls": {
+                    "type": "object",
+                    "properties": {
+                        "selfSigned": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "description": "Whether a self-signed TLS certificate for oauth2-proxy HTTPS is generated and used.",
+                                    "default": false
+                                }
+                            }
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the OAuth2 Proxy container.",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the OAuth2 Proxy container.",
+                                    "default": "64Mi"
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "authentication": {
+            "type": "object",
+            "properties": {
+                "cookieSecretName": {
+                    "type": "string",
+                    "description": "Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable",
+                    "default": ""
+                },
+                "openshift": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.",
+                            "default": true
+                        },
+                        "clusterRole": {
+                            "type": "object",
+                            "properties": {
+                                "name": {
+                                    "type": "string",
+                                    "description": "The name of the ClusterRole to bind for the OpenShift OAuth Proxy",
+                                    "default": "system:auth-delegator"
+                                }
+                            }
+                        }
+                    }
+                },
+                "basicAuth": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether Cryostat should use basic authentication for users. When false, Cryostat will not perform any form of authentication",
+                            "default": false
+                        },
+                        "secretName": {
+                            "type": "string",
+                            "description": "Name of the Secret that contains the credentials within Cryostat's namespace **(Required if basicAuth is enabled)**",
+                            "default": ""
+                        },
+                        "filename": {
+                            "type": "string",
+                            "description": "Key within Secret containing the `htpasswd` file. The file should contain one user definition entry per line, with the syntax \"user:passHash\", where \"user\" is the username and \"passHash\" is the `bcrypt` hash of the desired password. Such an entry can be generated with ex. `htpasswd -nbB username password` **(Required if basicAuth is enabled)**",
+                            "default": ""
+                        }
+                    }
+                }
+            }
+        },
+        "openshiftOauthProxy": {
+            "type": "object",
+            "properties": {
+                "securityContext": {
+                    "type": "object",
+                    "properties": {
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "description": "",
+                                    "default": [
+                                        "ALL"
+                                    ],
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean",
+                            "description": "",
+                            "default": false
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "repository": {
+                            "type": "string",
+                            "description": "Repository for the OpenShift OAuth Proxy container image",
+                            "default": "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+                        },
+                        "pullPolicy": {
+                            "type": "string",
+                            "description": "Image pull policy for the OpenShift OAuth Proxy container image",
+                            "default": "IfNotPresent"
+                        },
+                        "tag": {
+                            "type": "string",
+                            "description": "Tag for the OpenShift OAuth Proxy container image",
+                            "default": "4.0.3"
+                        }
+                    }
+                },
+                "resources": {
+                    "type": "object",
+                    "properties": {
+                        "requests": {
+                            "type": "object",
+                            "properties": {
+                                "cpu": {
+                                    "type": "string",
+                                    "description": "CPU resource request for the OpenShift OAuth Proxy container.",
+                                    "default": "25m"
+                                },
+                                "memory": {
+                                    "type": "string",
+                                    "description": "Memory resource request for the OpenShift OAuth Proxy container.",
+                                    "default": "64Mi"
+                                }
+                            }
+                        }
+                    }
+                },
+                "accessReview": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Whether the SubjectAccessReview/TokenAccessReview role checks for users and clients are enabled. If this is disabled then the proxy will only check that the user has valid credentials or holds a valid token.",
+                            "default": true
+                        },
+                        "group": {
+                            "type": "string",
+                            "description": "The OpenShift resource group that the SubjectAccessReview/TokenAccessReview will be performed for. See https://github.com/openshift/oauth-proxy/?tab=readme-ov-file#delegate-authentication-and-authorization-to-openshift-for-infrastructure",
+                            "default": ""
+                        },
+                        "resource": {
+                            "type": "string",
+                            "description": "The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "pods"
+                        },
+                        "subresource": {
+                            "type": "string",
+                            "description": "The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "exec"
+                        },
+                        "name": {
+                            "type": "string",
+                            "description": "The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": ""
+                        },
+                        "namespace": {
+                            "type": "string",
+                            "description": "The OpenShift namespace that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "{{ .Release.Namespace }}"
+                        },
+                        "verb": {
+                            "type": "string",
+                            "description": "The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": "create"
+                        },
+                        "version": {
+                            "type": "string",
+                            "description": "The OpenShift resource version that the SubjectAccessReview/TokenAccessReview will be performed for.",
+                            "default": ""
+                        }
+                    }
+                }
+            }
+        },
+        "podSecurityContext": {
+            "type": "object",
+            "properties": {
+                "seccompProfile": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string",
+                            "description": "",
+                            "default": "RuntimeDefault"
+                        }
+                    }
+                },
+                "runAsNonRoot": {
+                    "type": "boolean",
+                    "description": "",
+                    "default": true
+                }
+            }
+        },
+        "imagePullSecrets": {
+            "type": "array",
+            "description": "Image pull secrets to be used for the Cryostat deployment",
+            "default": [],
+            "items": {}
+        },
+        "nameOverride": {
+            "type": "string",
+            "description": "Overrides the name of this Chart",
+            "default": ""
+        },
+        "fullnameOverride": {
+            "type": "string",
+            "description": "Overrides the fully qualified application name of `[release name]-[chart name]`",
+            "default": ""
+        },
+        "rbac": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean",
+                    "description": "Specifies whether RBAC resources should be created",
+                    "default": true
+                }
+            }
+        },
+        "serviceAccount": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean",
+                    "description": "Specifies whether a service account should be created",
+                    "default": true
+                },
+                "name": {
+                    "type": "string",
+                    "description": "The name of the service account to use. If not set and create is true, a name is generated using the fullname template",
+                    "default": ""
+                }
+            }
+        },
+        "networkPolicy": {
+            "type": "object",
+            "properties": {
+                "ingress": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.",
+                            "default": true
+                        }
+                    }
+                }
+            }
+        },
+        "tolerations": {
+            "type": "array",
+            "description": "default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)",
+            "default": [],
+            "items": {}
+        }
+    }
+}
\ No newline at end of file
diff --git a/charts/redhat/redhat/redhat-cryostat/2.0.3/src/values.yaml b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/values.yaml
new file mode 100644
index 000000000..070b6b52a
--- /dev/null
+++ b/charts/redhat/redhat/redhat-cryostat/2.0.3/src/values.yaml
@@ -0,0 +1,456 @@
+## @section Cryostat Container
+## @extra core Configuration for the core Cryostat application
+core:
+  image:
+    ## @param core.image.repository Repository for the main Cryostat container image
+    repository: "registry.redhat.io/cryostat/cryostat-rhel9"
+    ## @param core.image.pullPolicy Image pull policy for the main Cryostat container image
+    pullPolicy: IfNotPresent
+    ## @param core.image.tag Tag for the main Cryostat container image
+    tag: "4.0.3"
+  ## @param core.podAnnotations [object] Annotations to be applied to the Cryostat Pods
+  podAnnotations: {}
+  service:
+    ## @param core.service.type Type of Service to create for the Cryostat application
+    type: ClusterIP
+    ## @param core.service.httpPort Port number to expose on the Service for Cryostat's HTTP server
+    httpPort: 8181
+  debug:
+    log:
+      ## @param core.debug.log.level Log level for troubleshooting and debugging
+      level: INFO
+  ## @param core.sslProxied Enables SSL Proxied Environment Variables, useful when you are offloading SSL/TLS at External Loadbalancer instead of Ingress
+  sslProxied: false
+  ingress:
+    ## @param core.ingress.enabled Whether to create an Ingress object for the Cryostat service
+    enabled: false
+    ## @param core.ingress.className Ingress class name for the Cryostat application Ingress
+    className: ""
+    ## @param core.ingress.annotations [object] Annotations to apply to the Cryostat application Ingress
+    annotations: {}
+    ## @param core.ingress.hosts [array] Hosts to create rules for in the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)
+    hosts:
+      - host: cryostat.local
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+    ## @param core.ingress.tls [array] TLS configuration for the Cryostat application Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec)
+    tls: []
+  route:
+    ## @param core.route.enabled Whether to create a Route object for the Cryostat service. Available only on OpenShift
+    enabled: true
+    tls:
+      ## @param core.route.tls.enabled Whether to secure the Cryostat application Route with TLS. See: [TLSConfig](https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/route-route-openshift-io-v1.html#spec-tls)
+      enabled: true
+      ## @param core.route.tls.termination Type of TLS termination to use for the Cryostat application Route. One of: `edge`, `passthrough`, `reencrypt`
+      termination: edge
+      ## @param core.route.tls.insecureEdgeTerminationPolicy Specify how to handle insecure traffic for the Cryostat application Route. One of: `Allow`, `Disable`, `Redirect`
+      insecureEdgeTerminationPolicy: Redirect
+      ## @param core.route.tls.key Custom private key to use when securing the Cryostat application Route
+      key: ""
+      ## @param core.route.tls.certificate Custom certificate to use when securing the Cryostat application Route
+      certificate: ""
+      ## @param core.route.tls.caCertificate Custom CA certificate to use, if needed to complete the certificate chain, when securing the Cryostat application Route
+      caCertificate: ""
+      ## @param core.route.tls.destinationCACertificate Provides the contents of the CA certificate of the final destination when using reencrypt termination for the Cryostat application Route
+      destinationCACertificate: ""
+  resources:
+    requests:
+      ## @param core.resources.requests.cpu CPU resource request for the Cryostat container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 500m
+      ## @param core.resources.requests.memory Memory resource request for the Cryostat container.
+      memory: 384Mi
+  ## @param core.securityContext [object] Security Context for the Cryostat container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip core.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip core.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param core.databaseSecretName Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data stored within the database, such as the target credentials keyring. It must not be updated across chart upgrades. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  databaseSecretName: ""
+  ## @extra core.discovery Configuration options to the Cryostat application's target discovery mechanisms
+  discovery:
+    kubernetes:
+      ## @param core.discovery.kubernetes.enabled Enables Kubernetes API discovery mechanism
+      enabled: true
+      ## @param core.discovery.kubernetes.installNamespaceDisabled When false and `namespaces` is empty, the Cryostat application will default to discovery targets in the install namespace (i.e. `{{ .Release.Namespace }}`)
+      installNamespaceDisabled: false
+      ## @param core.discovery.kubernetes.namespaces [array] List of namespaces whose workloads the Cryostat application should be permitted to access and profile
+      namespaces: []
+      ## @param core.discovery.kubernetes.builtInPortNamesDisabled When false and `portNames` is empty, the Cryostat application will use the default port name `jfr-jmx` to look for JMX connectable targets.
+      builtInPortNamesDisabled: false
+      ## @param core.discovery.kubernetes.portNames [array] List of port names that the Cryostat application should look for in order to consider a target as JMX connectable
+      portNames: []
+      ## @param core.discovery.kubernetes.builtInPortNumbersDisabled When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.
+      builtInPortNumbersDisabled: false
+      ## @param core.discovery.kubernetes.portNumbers [array] List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable
+      portNumbers: []
+  config:
+    eventTemplates:
+      ## @param core.config.eventTemplates.configMapNames [array] List of ConfigMap names. Each ConfigMap is expected to contain one or more files, which are .jfc (XML) JFR Event Templates, to be mounted to the Cryostat container.
+      configMapNames: []
+    tlsTruststore:
+      ## @param core.config.tlsTruststore.secretNames [array] List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.
+      secretNames: []
+  ## @param core.nodeSelector [object] Node Selector for the Cryostat Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param core.tolerations [array] Tolerations for the Cryostat Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param core.affinity [object] Affinity for the Cryostat Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Report Generator Deployment
+## @extra reports Configuration for the Reports Generator deployment
+reports:
+  image:
+    ## @param reports.image.repository Repository for the Report Generator container image
+    repository: "registry.redhat.io/cryostat/cryostat-reports-rhel9"
+    ## @param reports.image.pullPolicy Image pull policy for the Report Generator container image
+    pullPolicy: IfNotPresent
+    ## @param reports.image.tag Tag for the Report Generator image
+    tag: "4.0.3"
+  ## @param reports.podAnnotations [object] Annotations to be applied to the Report Generator Pods
+  podAnnotations: {}
+  service:
+    ## @param reports.service.type Type of Service to create for the Report Generator Deployment
+    type: ClusterIP
+    ## @param reports.service.httpPort Port number to expose on the Service for the Report Generator Deployment
+    httpPort: 10001
+  ## @param reports.reportsSecretName Name of the secret containing the report generator access keys. This secret must contain a REPORTS_PASS secret which is the secret credential for the report generators. It must not be updated across chart upgrades, or else the connection between Cryostat and report generators will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  reportsSecretName: ""
+  debug:
+    log:
+      ## @param reports.debug.log.level Log level for troubleshooting and debugging
+      level: INFO
+  ## @param reports.replicas Number of Report Generator replicas to deploy. If zero, the Deployment and Service will not be created and the main Cryostat container will handle all report generations on its own.
+  replicas: 0
+  resources:
+    requests:
+      ## @param reports.resources.requests.cpu CPU resource request for each Pod in the Report Generator Deployment.
+      cpu: 500m
+      ## @param reports.resources.requests.memory Memory resource request for each Pod in the Report Generator Deployment.
+      memory: 512Mi
+  ## @param reports.securityContext [object] Security Context for the Report Generator containers. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip reports.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip reports.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param reports.nodeSelector [object] Node Selector for the Report Generator Pods. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param reports.tolerations [array] Tolerations for the Report Generator Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param reports.affinity [object] Affinity for the Report Generator Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Database Container
+## @extra db Configuration for Cryostat's database
+db:
+  image:
+    ## @param db.image.repository Repository for the database container image
+    repository: "registry.redhat.io/cryostat/cryostat-db-rhel9"
+    ## @param db.image.pullPolicy Image pull policy for the database container image
+    pullPolicy: IfNotPresent
+    ## @param db.image.tag Tag for the database container image
+    tag: "4.0.3"
+  ## @param db.podAnnotations [object] Annotations to be applied to the Database Pods
+  podAnnotations: {}
+  service:
+    ## @param db.service.type Type of Service to create for the database
+    type: ClusterIP
+    ## @param db.service.port Port number to expose on the Service
+    port: 5432
+  resources:
+    requests:
+      ## @param db.resources.requests.cpu CPU resource request for the database container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 25m
+      ## @param db.resources.requests.memory Memory resource request for the database container.
+      memory: 64Mi
+  pvc:
+    ## @param db.pvc.enabled Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.
+    enabled: false
+    ## @param db.pvc.annotations [object] Annotations to add to the persistentVolumeClaim
+    annotations: {}
+    ## @param db.pvc.storage Storage size to request for the persistentVolumeClaim
+    storage: 500Mi
+    ## @param db.pvc.accessModes Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    accessModes:
+      - ReadWriteOnce
+    ## @param db.pvc.selector [object] Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    selector: {}
+    ## @param db.pvc.storageClassName [string, nullable] The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    # storageClassName: ""
+  ## @param db.securityContext [object] Security Context for the database container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip db.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip db.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param db.nodeSelector [object] Node Selector for the Database Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param db.tolerations [array] Tolerations for the Database Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param db.affinity [object] Affinity for the Database Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Storage Container
+## @extra storage Configuration for Cryostat's object storage provider
+storage:
+  ## @param storage.storageSecretName Name of the secret containing the object storage secret access key. This secret must contain a STORAGE_ACCESS_KEY secret which is the object storage secret access key. It must not be updated across chart upgrades, or else the connection between Cryostat components and object storage will not be able to initialize. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  storageSecretName: ""
+  image:
+    ## @param storage.image.repository Repository for the storage container image
+    repository: "registry.redhat.io/cryostat/cryostat-storage-rhel9"
+    ## @param storage.image.pullPolicy Image pull policy for the storage container image
+    pullPolicy: IfNotPresent
+    ## @param storage.image.tag Tag for the storage container image
+    tag: "4.0.3"
+  encryption:
+    ## @param storage.encryption.enabled Enable at-rest encryption of stored objects. The storage container will generate a secret key for each stored object and use this key to encrypt and decrypt objects transparently. The key is written to the object metadata, so in the default storage container configuration this only adds a small layer of additional security.
+    enabled: true
+  ## @param storage.podAnnotations [object] Annotations to be applied to the Storage Pods
+  podAnnotations: {}
+  service:
+    ## @param storage.service.type Type of Service to create for the object storage
+    type: ClusterIP
+    ## @param storage.service.port Port number to expose on the Service
+    port: 8333
+  resources:
+    requests:
+      ## @param storage.resources.requests.cpu CPU resource request for the object storage container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 50m
+      ## @param storage.resources.requests.memory Memory resource request for the object storage container.
+      memory: 256Mi
+  pvc:
+    ## @param storage.pvc.enabled Specify whether to use persistentVolumeClaim (true) or EmptyDir storage (false). This is recommended to be enabled, but the storage size and selector should be chosen carefully first.
+    enabled: false
+    ## @param storage.pvc.annotations [object] Annotations to add to the persistentVolumeClaim
+    annotations: {}
+    ## @param storage.pvc.storage Storage size to request for the persistentVolumeClaim
+    storage: 500Mi
+    ## @param storage.pvc.accessModes Access mode for the persistentVolumeClaim. See: [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    accessModes:
+      - ReadWriteOnce
+    ## @param storage.pvc.selector [object] Selector for the persistentVolumeClaim. See: [Selector](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    selector: {}
+    ## @param storage.pvc.storageClassName [string, nullable] The name of the StorageClass for the persistentVolumeClaim. See: [Class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)
+    # storageClassName: ""
+  ## @param storage.securityContext [object] Security Context for the storage container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip storage.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip storage.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param storage.nodeSelector [object] Node Selector for the Storage Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param storage.tolerations [array] Tolerations for the Storage Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+  ## @param storage.affinity [object] Affinity for the Storage Pod. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  affinity: {}
+
+## @section Grafana Container
+## @extra grafana Configuration for the customized Grafana instance for Cryostat
+grafana:
+  image:
+    ## @param grafana.image.repository Repository for the Grafana container image
+    repository: "registry.redhat.io/cryostat/cryostat-grafana-dashboard-rhel9"
+    ## @param grafana.image.pullPolicy Image pull policy for the Grafana container image
+    pullPolicy: IfNotPresent
+    ## @param grafana.image.tag Tag for the Grafana container image
+    tag: "4.0.3"
+  service:
+    ## @param grafana.service.type Type of Service to create for Grafana
+    type: ClusterIP
+    ## @param grafana.service.port Port number to expose on the Service for Grafana's HTTP server
+    port: 3000
+  resources:
+    requests:
+      ## @param grafana.resources.requests.cpu CPU resource request for the Grafana container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 25m
+      ## @param grafana.resources.requests.memory Memory resource request for the Grafana container.
+      memory: 80Mi
+  ## @param grafana.securityContext [object] Security Context for the Grafana container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip grafana.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip grafana.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param grafana.nodeSelector [object] Node Selector for the Grafana Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param grafana.tolerations [array] Tolerations for the Grafana Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+
+## @section JFR Data Source Container
+## @extra datasource Configuration for the JFR Data Source component, which translates recording events into a format consumable by Grafana
+datasource:
+  image:
+    ## @param datasource.image.repository Repository for the JFR Data Source container image
+    repository: "registry.redhat.io/cryostat/jfr-datasource-rhel9"
+    ## @param datasource.image.pullPolicy Image pull policy for the JFR Data Source container image
+    pullPolicy: IfNotPresent
+    ## @param datasource.image.tag Tag for the JFR Data Source container image
+    tag: "4.0.3"
+  resources:
+    requests:
+      ## @param datasource.resources.requests.cpu CPU resource request for the JFR Data Source container. See: [ResourceRequirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources)
+      cpu: 200m
+      ## @param datasource.resources.requests.memory Memory resource request for the JFR Data Source container.
+      memory: 200Mi
+  ## @param datasource.securityContext [object] Security Context for the JFR Data Source container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip datasource.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip datasource.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+  ## @param datasource.nodeSelector [object] Node Selector for the JFR Datasource Pod. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  nodeSelector: {}
+  ## @param datasource.tolerations [array] Tolerations for the JFR Datasource Pod. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+  tolerations: []
+
+## @section Authentication
+
+authentication:
+  ## @param authentication.cookieSecretName Name of the secret containing the authenticating proxy cookie encryption key. This secret must contain a COOKIE_SECRET secret which is the cookie encryption key. It must not be updated across chart upgrades, or else existing user login sessions will be invalidated. It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data. More details: https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable
+  cookieSecretName: ""
+  openshift:
+    ## @param authentication.openshift.enabled Whether the OAuth Proxy deployed for securing Cryostat's Pods should be one that integrates with OpenShift-specific features, or a generic one.
+    enabled: true
+    clusterRole:
+      ## @param authentication.openshift.clusterRole.name The name of the ClusterRole to bind for the OpenShift OAuth Proxy
+      name: system:auth-delegator
+  basicAuth:
+    ## @param authentication.basicAuth.enabled Whether Cryostat should use basic authentication for users. When false, Cryostat will not perform any form of authentication
+    enabled: false
+    ## @param authentication.basicAuth.secretName Name of the Secret that contains the credentials within Cryostat's namespace **(Required if basicAuth is enabled)**
+    secretName: ""
+    ## @param authentication.basicAuth.filename Key within Secret containing the `htpasswd` file. The file should contain one user definition entry per line, with the syntax "user:passHash", where "user" is the username and "passHash" is the `bcrypt` hash of the desired password. Such an entry can be generated with ex. `htpasswd -nbB username password` **(Required if basicAuth is enabled)**
+    filename: ""
+
+## @section OAuth2 Proxy
+
+oauth2Proxy:
+  image:
+    ## @param oauth2Proxy.image.repository Repository for the OAuth2 Proxy container image
+    repository: ""
+    ## @param oauth2Proxy.image.pullPolicy Image pull policy for the OAuth2 Proxy container image
+    pullPolicy: Never
+    ## @param oauth2Proxy.image.tag Tag for the OAuth2 Proxy container image
+    tag: ""
+  tls:
+    selfSigned:
+      ## @param oauth2Proxy.tls.selfSigned.enabled Whether a self-signed TLS certificate for oauth2-proxy HTTPS is generated and used.
+      enabled: false
+  resources:
+    requests:
+      ## @param oauth2Proxy.resources.requests.cpu CPU resource request for the OAuth2 Proxy container.
+      cpu: 25m
+      ## @param oauth2Proxy.resources.requests.memory Memory resource request for the OAuth2 Proxy container.
+      memory: 64Mi
+  ## @param oauth2Proxy.securityContext [object] Security Context for the OAuth2 Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1).
+  securityContext:
+    ## @skip oauth2Proxy.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip oauth2Proxy.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+
+## @section OpenShift OAuth Proxy
+
+openshiftOauthProxy:
+  image:
+    ## @param openshiftOauthProxy.image.repository Repository for the OpenShift OAuth Proxy container image
+    repository: "registry.redhat.io/cryostat/cryostat-ose-oauth-proxy-rhel9"
+    ## @param openshiftOauthProxy.image.pullPolicy Image pull policy for the OpenShift OAuth Proxy container image
+    pullPolicy: IfNotPresent
+    ## @param openshiftOauthProxy.image.tag Tag for the OpenShift OAuth Proxy container image
+    tag: "4.0.3"
+  resources:
+    requests:
+      ## @param openshiftOauthProxy.resources.requests.cpu CPU resource request for the OpenShift OAuth Proxy container.
+      cpu: 25m
+      ## @param openshiftOauthProxy.resources.requests.memory Memory resource request for the OpenShift OAuth Proxy container.
+      memory: 64Mi
+  accessReview:
+    ## @param openshiftOauthProxy.accessReview.enabled Whether the SubjectAccessReview/TokenAccessReview role checks for users and clients are enabled. If this is disabled then the proxy will only check that the user has valid credentials or holds a valid token.
+    enabled: true
+    ## @param openshiftOauthProxy.accessReview.group The OpenShift resource group that the SubjectAccessReview/TokenAccessReview will be performed for. See https://github.com/openshift/oauth-proxy/?tab=readme-ov-file#delegate-authentication-and-authorization-to-openshift-for-infrastructure
+    group: ""
+    ## @param openshiftOauthProxy.accessReview.resource The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.
+    resource: "pods"
+    ## @param openshiftOauthProxy.accessReview.subresource The OpenShift resource that the SubjectAccessReview/TokenAccessReview will be performed for.
+    subresource: "exec"
+    ## @param openshiftOauthProxy.accessReview.name The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.
+    name: ""
+    ## @param openshiftOauthProxy.accessReview.namespace The OpenShift namespace that the SubjectAccessReview/TokenAccessReview will be performed for.
+    namespace: "{{ .Release.Namespace }}"
+    ## @param openshiftOauthProxy.accessReview.verb The OpenShift resource name that the SubjectAccessReview/TokenAccessReview will be performed for.
+    verb: "create"
+    ## @param openshiftOauthProxy.accessReview.version The OpenShift resource version that the SubjectAccessReview/TokenAccessReview will be performed for.
+    version: ""
+  ## @param openshiftOauthProxy.securityContext [object] Security Context for the OpenShift OAuth Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip openshiftOauthProxy.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip openshiftOauthProxy.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+
+## @section Other Parameters
+
+## @param imagePullSecrets [array] Image pull secrets to be used for the Cryostat deployment
+imagePullSecrets: []
+## @param nameOverride Overrides the name of this Chart
+nameOverride: ""
+## @param fullnameOverride Overrides the fully qualified application name of `[release name]-[chart name]`
+fullnameOverride: ""
+
+rbac:
+  ## @param rbac.create Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  ## @param serviceAccount.create Specifies whether a service account should be created
+  create: true
+  ## @param serviceAccount.annotations [object] Annotations to add to the service account
+  annotations: {}
+  ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+## @param podAnnotations [object] Annotations to be applied to the various Pods
+podAnnotations: {}
+
+## @param podSecurityContext [object] Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context)
+podSecurityContext:
+  ## @skip podSecurityContext.runAsNonRoot
+  runAsNonRoot: true
+  ## @skip podSecurityContext.seccompProfile
+  seccompProfile:
+    type: RuntimeDefault
+
+networkPolicy:
+  ingress:
+    ## @param networkPolicy.ingress.enabled whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.
+    enabled: true
+
+## @param nodeSelector [object] default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+nodeSelector: {}
+
+## @param tolerations [array] default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+tolerations: []
+
+## @param affinity [object] default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling)
+affinity: {}
diff --git a/charts/redhat/redhat/redhat-developer-hub-orchestrator-infra/1.7.0/redhat-developer-hub-orchestrator-infra-1.7.0.tgz b/charts/redhat/redhat/redhat-developer-hub-orchestrator-infra/1.7.0/redhat-developer-hub-orchestrator-infra-1.7.0.tgz
new file mode 100644
index 000000000..07bff56ce
Binary files /dev/null and b/charts/redhat/redhat/redhat-developer-hub-orchestrator-infra/1.7.0/redhat-developer-hub-orchestrator-infra-1.7.0.tgz differ
diff --git a/charts/redhat/redhat/redhat-developer-hub-orchestrator-infra/1.7.1/redhat-developer-hub-orchestrator-infra-1.7.1.tgz b/charts/redhat/redhat/redhat-developer-hub-orchestrator-infra/1.7.1/redhat-developer-hub-orchestrator-infra-1.7.1.tgz
new file mode 100644
index 000000000..ff298fae2
Binary files /dev/null and b/charts/redhat/redhat/redhat-developer-hub-orchestrator-infra/1.7.1/redhat-developer-hub-orchestrator-infra-1.7.1.tgz differ
diff --git a/charts/redhat/redhat/redhat-developer-hub/1.6.4/redhat-developer-hub-1.6.4.tgz b/charts/redhat/redhat/redhat-developer-hub/1.6.4/redhat-developer-hub-1.6.4.tgz
new file mode 100644
index 000000000..606d9aac9
Binary files /dev/null and b/charts/redhat/redhat/redhat-developer-hub/1.6.4/redhat-developer-hub-1.6.4.tgz differ
diff --git a/charts/redhat/redhat/redhat-developer-hub/1.6.5/redhat-developer-hub-1.6.5.tgz b/charts/redhat/redhat/redhat-developer-hub/1.6.5/redhat-developer-hub-1.6.5.tgz
new file mode 100644
index 000000000..c02a96077
Binary files /dev/null and b/charts/redhat/redhat/redhat-developer-hub/1.6.5/redhat-developer-hub-1.6.5.tgz differ
diff --git a/charts/redhat/redhat/redhat-developer-hub/1.7.0/redhat-developer-hub-1.7.0.tgz b/charts/redhat/redhat/redhat-developer-hub/1.7.0/redhat-developer-hub-1.7.0.tgz
new file mode 100644
index 000000000..3dfb24ee7
Binary files /dev/null and b/charts/redhat/redhat/redhat-developer-hub/1.7.0/redhat-developer-hub-1.7.0.tgz differ
diff --git a/charts/redhat/redhat/redhat-developer-hub/1.7.1/redhat-developer-hub-1.7.1.tgz b/charts/redhat/redhat/redhat-developer-hub/1.7.1/redhat-developer-hub-1.7.1.tgz
new file mode 100644
index 000000000..15a949193
Binary files /dev/null and b/charts/redhat/redhat/redhat-developer-hub/1.7.1/redhat-developer-hub-1.7.1.tgz differ
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/Chart.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/Chart.yaml
new file mode 100644
index 000000000..e949d4a91
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/Chart.yaml
@@ -0,0 +1,19 @@
+description: |-
+  This content is experimental, do not use it in production. MariaDB database service, with persistent storage.
+  For more information about using this template, including OpenShift considerations,
+  see https://github.com/sclorg/mariadb-container/blob/master/10.11/root/usr/share/container-scripts/mysql/README.md.
+
+  NOTE: Scaling to more than one replica is not supported.
+  You must have persistent volumes available in your cluster to use this template.
+name: redhat-mariadb-persistent
+tags: database,mariadb
+version: 0.0.3
+kubeVersion: '>=1.20.0'
+annotations:
+  charts.openshift.io/name: Red Hat MariaDB database service, with persistent storage (experimental)
+  charts.openshift.io/provider: Red Hat
+  charts.openshift.io/providerType: redhat
+apiVersion: v2
+appVersion: 0.0.3
+sources:
+  - https://github.com/sclorg/helm-charts
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/README.md b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/README.md
new file mode 100644
index 000000000..0194e3cb6
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/README.md
@@ -0,0 +1,22 @@
+# MariaDB helm chart
+
+A Helm chart for building and deploying a [MariaDB](https://github/sclorg/mariadb-container) application on OpenShift.
+
+For more information about helm charts see the official [Helm Charts Documentation](https://helm.sh/).
+
+You need to have access to a cluster for each operation with OpenShift 4, like deploying and testing.
+
+## Values
+Below is a table of each value used to configure this chart.
+
+| Value                                       | Description | Default | Additional Information |
+|---------------------------------------------| ----------- | -- | ---------------------- |
+| `database_service_name`                     | The name of the OpenShift Service exposed for the database. | `mariadb` | - |
+| `mysql_user`                                | Username for MariaDB user that will be used for accessing the database. | - | Expresion like: `user[A-Z0-9]{3}` |
+| `mysql_root_password`                       | Password for the MariaDB root user. | | Expression like: `[a-zA-Z0-9]{16}` |
+| `mysql_database`                            | Name of the MariaDB database accessed. | `sampledb` |  |
+| `mysql_password`                            | Password for the MariaDB connection user. |  | Expression like: `[a-zA-Z0-9]{16}` |
+| `mariadb_version`                             | Version of MariaDB image to be used (10.3-el7, 10.3-el8, or latest). | `10.3-el8` |  |
+| `namespace`                                 | The OpenShift Namespace where the ImageStream resides. | `openshift` | |
+| `memory_limit`                              | Maximum amount of memory the container can use. | `521Mi` |  |
+| `volume_capacity`                           | Volume space available for data, e.g. 512Mi, 2Gi. | `1Gi` |  |
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/deployment.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/deployment.yaml
new file mode 100644
index 000000000..b65830e7f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/deployment.yaml
@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    template.alpha.openshift.io/wait-for-ready: "true"
+    image.openshift.io/triggers: |-
+      [
+        {
+          "from": {
+            "kind": "ImageStreamTag",
+            "name": "mariadb:{{ .Values.mariadb_version }}"
+          },
+          "fieldPath": "spec.template.spec.containers[0].image"
+        }
+      ]
+  labels:
+    app.openshift.io/runtime: mariadb
+    template: mariadb-persistent-template
+  name: {{ .Values.database_service_name }}
+
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      name: {{ .Values.database_service_name }}
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        name: {{ .Values.database_service_name }}
+    spec:
+      containers:
+      - env:
+        - name: MYSQL_USER
+          valueFrom:
+            secretKeyRef:
+              key: database-user
+              name: {{ .Values.database_service_name }}
+        - name: MYSQL_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: database-password
+              name: {{ .Values.database_service_name }}
+        - name: MYSQL_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: database-root-password
+              name: {{ .Values.database_service_name }}
+        - name: MYSQL_DATABASE
+          valueFrom:
+            secretKeyRef:
+              key: database-name
+              name: {{ .Values.database_service_name }}
+        image: "mariadb:{{ .Values.mariadb_version }}"
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -i
+            - -c
+            - MYSQL_PWD="$MYSQL_PASSWORD" mysqladmin -u $MYSQL_USER ping
+          initialDelaySeconds: 30
+          timeoutSeconds: 1
+        name: mariadb
+        ports:
+        - containerPort: 3306
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -i
+            - -c
+            - MYSQL_PWD="$MYSQL_PASSWORD" mysqladmin -u $MYSQL_USER ping
+          initialDelaySeconds: 5
+          timeoutSeconds: 1
+        resources:
+          limits:
+            memory: {{ .Values.memory_limit }}
+        volumeMounts:
+        - mountPath: /var/lib/mysql/data
+          name: {{ .Values.database_service_name }}-data
+      volumes:
+      - name: {{ .Values.database_service_name }}-data
+        persistentVolumeClaim:
+          claimName: {{ .Values.database_service_name }}
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/persistentvolumeclaim.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/persistentvolumeclaim.yaml
new file mode 100644
index 000000000..fba72619c
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/persistentvolumeclaim.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.openshift.io/runtime: mariadb
+    template: mariadb-persistent-template
+  name: {{ .Values.database_service_name }}
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.volume_capacity }}
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/secret.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/secret.yaml
new file mode 100644
index 000000000..8ae14d904
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    template.openshift.io/expose-database_name: ".data['database-name']}"
+    template.openshift.io/expose-password: "{.data['database-password']}"
+    template.openshift.io/expose-root_password: "{.data['database-root-password']}"
+    template.openshift.io/expose-username: "{.data['database-user']}"
+  labels:
+    app.openshift.io/runtime: mariadb
+    template: mariadb-persistent-template
+  name: {{ .Values.database_service_name }}
+stringData:
+  database-name: {{ .Values.mysql_database }}
+  database-password: {{ .Values.mysql_password }}
+  database-root-password: {{ .Values.mysql_root_password }}
+  database-user: {{ .Values.mysql_user }}
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/service.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/service.yaml
new file mode 100644
index 000000000..717cd1168
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    template.openshift.io/expose-uri: mysql://{.spec.clusterIP}:{.spec.ports[?(.name=="mariadb")].port}
+  labels:
+    app.openshift.io/runtime: mariadb
+    template: mariadb-persistent-template
+  name: {{ .Values.database_service_name }}
+spec:
+  ports:
+  - name: mariadb
+    port: 3306
+  selector:
+    name: {{ .Values.database_service_name }}
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/tests/test-mariadb-connection.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/tests/test-mariadb-connection.yaml
new file mode 100644
index 000000000..87abe997a
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/templates/tests/test-mariadb-connection.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ .Release.Name }}-connection-test"
+  namespace: "{{ .Release.Namespace }}"
+  annotations:
+    "helm.sh/hook": test
+  labels:
+    name: {{ .Values.database_service_name }}
+spec:
+  #serviceAccount: {{ .Values.serviceAccount }}
+  containers:
+    - name: "mariadb-connection-test"
+      image: "registry.redhat.io/rhel8/mariadb-105:latest"
+      imagePullPolicy: IfNotPresent
+      env:
+        - name: MARIADB_USER
+          value: "{{ .Values.mysql_user }}"
+        - name: MARIADB_PASSWORD
+          value: "{{ .Values.mysql_password }}"
+        - name: MARIADB_DATABASE
+          value: "{{ .Values.mysql_database }}"
+      command:
+        - /bin/bash
+        - -ec
+        - "echo \"SELECT 42 as testval\\g\" | mysql --connect-timeout=15 -h {{ .Values.database_service_name }} $MARIADB_DATABASE -u$MARIADB_USER -p$MARIADB_PASSWORD"
+  restartPolicy: Never
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/values.schema.json b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/values.schema.json
new file mode 100644
index 000000000..65abd8f5f
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/values.schema.json
@@ -0,0 +1,49 @@
+{
+    "$schema": "http://json-schema.org/schema#",
+    "type": "object",
+    "properties": {
+        "database_service_name": {
+            "type": "string",
+            "pattern": "^[a-z0-9-_]+$"
+        },
+        "namespace": {
+            "type": "string"
+        },
+        "mysql_database": {
+            "type": "string"
+        },
+        "mysql_password": {
+            "type": "string"
+        },
+        "mysql_root_password": {
+            "type": "string"
+        },
+        "mysql_user": {
+            "type": "string"
+        },
+        "volume_capacity": {
+            "type": "string",
+            "title": "Persistent Volume Size",
+            "form": true,
+            "render": "slider",
+            "sliderMin": 1,
+            "sliderMax": 100,
+            "sliderUnit": "Gi"
+        },
+        "memory_limit": {
+            "type": "string",
+            "title": "Database memory limit",
+            "form": true,
+            "render": "slider",
+            "sliderMin": 512,
+            "sliderMax": 65536,
+            "sliderUnit": "Mi"
+        },
+        "mariadb_version": {
+            "type": "string",
+            "description": "Specify mariadb imagestream tag",
+            "enum": [ "latest", "10.5-el9", "10.3-el8", "10.5-el8", "10.3-el7", "10.3", "10.5-el7" ]
+        }
+    }
+}
+
diff --git a/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/values.yaml b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/values.yaml
new file mode 100644
index 000000000..5fcdee1d2
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mariadb-persistent/0.0.3/src/values.yaml
@@ -0,0 +1,9 @@
+database_service_name: mariadb
+mariadb_version: 10.3-el8
+memory_limit: 512Mi
+mysql_database: testdb
+mysql_password: testu
+mysql_root_password: testur
+mysql_user: testu
+namespace: openshift
+volume_capacity: 1Gi
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/Chart.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/Chart.yaml
new file mode 100644
index 000000000..8b4c11dc6
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/Chart.yaml
@@ -0,0 +1,20 @@
+description: |-
+  This content is experimental, do not use it in production.
+  MySQL database service, with persistent storage.
+  For more information about using this template, including OpenShift considerations,
+  see https://github.com/sclorg/mysql-container/blob/master/8.0/root/usr/share/container-scripts/mysql/README.md.
+
+  NOTE: Scaling to more than one replica is not supported.
+  You must have persistent volumes available in your cluster to use this template.
+name: redhat-mysql-persistent
+tags: database,mysql
+version: 0.0.5
+annotations:
+  charts.openshift.io/name: Red Hat MySQL database service, with persistent storage (experimental)
+  charts.openshift.io/provider: Red Hat
+  charts.openshift.io/providerType: redhat
+apiVersion: v2
+appVersion: 0.0.5
+kubeVersion: '>=1.20.0'
+sources:
+  - https://github.com/sclorg/helm-charts
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/README.md b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/README.md
new file mode 100644
index 000000000..4938a2348
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/README.md
@@ -0,0 +1,22 @@
+# MySQL helm chart
+
+A Helm chart for building and deploying a [MySQL](https://github/sclorg/mysql-container) application on OpenShift.
+
+For more information about helm charts see the official [Helm Charts Documentation](https://helm.sh/).
+
+You need to have access to a cluster for each operation with OpenShift 4, like deploying and testing.
+
+## Values
+Below is a table of each value used to configure this chart.
+
+| Value                                       | Description | Default | Additional Information |
+|---------------------------------------------| ----------- | -- | ---------------------- |
+| `database_service_name`                     | The name of the OpenShift Service exposed for the database. | `mysql` | - |
+| `mysql_user`                                | Username for MySQL user that will be used for accessing the database. | `testu` | Expresion like: `user[A-Z0-9]{3}` |
+| `mysql_root_password`                       | Password for the MySQL root user. | `testur` | Expression like: `[a-zA-Z0-9]{16}` |
+| `mysql_database`                            | Name of the MySQL database accessed. | `testdb` |  |
+| `mysql_password`                            | Password for the MySQL connection user. | `testp` | Expression like: `[a-zA-Z0-9]{16}` |
+| `mysql_version`                             | Version of MySQL image to be used (8.0-el8, or latest). | `8.0-el8` |  |
+| `namespace`                                 | The OpenShift Namespace where the ImageStream resides. | `mysql-persistent-testing` | |
+| `memory_limit`                              | Maximum amount of memory the container can use. | `521Mi` |  |
+| `volume_capacity`                           | Volume space available for data, e.g. 512Mi, 2Gi. | `1Gi` |  |
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/deployment.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/deployment.yaml
new file mode 100644
index 000000000..ca4cc6ab9
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/deployment.yaml
@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    template.alpha.openshift.io/wait-for-ready: "true"
+    image.openshift.io/triggers: |-
+      [
+        {
+          "from": {
+            "kind": "ImageStreamTag",
+            "name": "mysql:{{ .Values.mysql_version }}"
+          },
+          "fieldPath": "spec.template.spec.containers[0].image"
+        }
+      ]
+  labels:
+    template: mysql-persistent-template
+  name: {{ .Values.database_service_name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      name: {{ .Values.database_service_name }}
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        name: {{ .Values.database_service_name }}
+    spec:
+      containers:
+      - env:
+        - name: MYSQL_USER
+          valueFrom:
+            secretKeyRef:
+              key: database-user
+              name: {{ .Values.database_service_name }}
+        - name: MYSQL_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: database-password
+              name: {{ .Values.database_service_name }}
+        - name: MYSQL_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: database-root-password
+              name: {{ .Values.database_service_name }}
+        - name: MYSQL_DATABASE
+          valueFrom:
+            secretKeyRef:
+              key: database-name
+              name: {{ .Values.database_service_name }}
+        image: " "
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -i
+            - -c
+            - MYSQL_PWD="$MYSQL_PASSWORD" mysqladmin -u $MYSQL_USER ping
+          initialDelaySeconds: 30
+          timeoutSeconds: 1
+        name: mysql
+        ports:
+        - containerPort: 3306
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -i
+            - -c
+            - MYSQL_PWD="$MYSQL_PASSWORD" mysqladmin -u $MYSQL_USER ping
+          initialDelaySeconds: 5
+          timeoutSeconds: 1
+        resources:
+          limits:
+            memory: {{ .Values.memory_limit }}
+        volumeMounts:
+        - mountPath: /var/lib/mysql/data
+          name: {{ .Values.database_service_name }}-data
+      volumes:
+      - name: {{ .Values.database_service_name }}-data
+        persistentVolumeClaim:
+          claimName: {{ .Values.database_service_name }}
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/persistentvolumeclaim.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/persistentvolumeclaim.yaml
new file mode 100644
index 000000000..a8b426454
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/persistentvolumeclaim.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    template: mysql-persistent-template
+  name: {{ .Values.database_service_name }}
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.volume_capacity }}
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/secret.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/secret.yaml
new file mode 100644
index 000000000..5cc981ad9
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    template.openshift.io/expose-database_name: '{.data[''database-name'']}'
+    template.openshift.io/expose-password: '{.data[''database-password'']}'
+    template.openshift.io/expose-root_password: '{.data[''database-root-password'']}'
+    template.openshift.io/expose-username: '{.data[''database-user'']}'
+  labels:
+    template: mysql-persistent-template
+  name: {{ .Values.database_service_name }}
+stringData:
+  database-name: {{ .Values.mysql_database }}
+  database-password: {{ .Values.mysql_password }}
+  database-root-password: {{ .Values.mysql_root_password }}
+  database-user: {{ .Values.mysql_user }}
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/service.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/service.yaml
new file mode 100644
index 000000000..a48fea4f0
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/service.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    template.openshift.io/expose-uri: mysql://{.spec.clusterIP}:{.spec.ports[?(.name=="mysql")].port}
+  labels:
+    template: mysql-persistent-template
+  name: {{ .Values.database_service_name }}
+spec:
+  ports:
+  - name: mysql
+    port: 3306
+  selector:
+    name: {{ .Values.database_service_name }}
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/tests/test-mysql-connection.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/tests/test-mysql-connection.yaml
new file mode 100644
index 000000000..b5ff9027a
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/templates/tests/test-mysql-connection.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ .Release.Name }}-connection-test"
+  namespace: "{{ .Release.Namespace }}"
+  annotations:
+    "helm.sh/hook": test
+  labels:
+    name: {{ .Values.database_service_name }}
+spec:
+  #serviceAccount: {{ .Values.serviceAccount }}
+  containers:
+    - name: "mysql-connection-test"
+      image: "registry.redhat.io/rhel8/mysql-80:latest"
+      imagePullPolicy: IfNotPresent
+      env:
+        - name: MARIADB_USER
+          value: "{{ .Values.mysql_user }}"
+        - name: MARIADB_PASSWORD
+          value: "{{ .Values.mysql_password }}"
+        - name: MARIADB_DATABASE
+          value: "{{ .Values.mysql_database }}"
+      command:
+        - /bin/bash
+        - -exc
+        - "echo \"SELECT 42 as testval\\g\" | mysql --connect-timeout=15 -h {{ .Values.database_service_name }} $MARIADB_DATABASE -u $MARIADB_USER -p$MARIADB_PASSWORD"
+  restartPolicy: Never
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/values.schema.json b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/values.schema.json
new file mode 100644
index 000000000..732c8c80d
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/values.schema.json
@@ -0,0 +1,49 @@
+{
+    "$schema": "http://json-schema.org/schema#",
+    "type": "object",
+    "properties": {
+        "database_service_name": {
+            "type": "string",
+            "pattern": "^[a-z0-9-_]+$"
+        },
+        "namespace": {
+            "type": "string"
+        },
+        "mysql_database": {
+            "type": "string"
+        },
+        "mysql_password": {
+            "type": "string"
+        },
+        "mysql_root_password": {
+            "type": "string"
+        },
+        "mysql_user": {
+            "type": "string"
+        },
+        "volume_capacity": {
+            "type": "string",
+            "title": "Persistent Volume Size",
+            "form": true,
+            "render": "slider",
+            "sliderMin": 1,
+            "sliderMax": 100,
+            "sliderUnit": "Gi"
+        },
+        "memory_limit": {
+            "type": "string",
+            "title": "Database memory limit",
+            "form": true,
+            "render": "slider",
+            "sliderMin": 512,
+            "sliderMax": 65536,
+            "sliderUnit": "Mi"
+        },
+        "mysql_version": {
+            "type": "string",
+            "description": "Specify mysql imagestream tag",
+            "enum": [ "latest", "8.0-el9", "8.0-el8", "8.0-el7" ]
+        }
+    }
+}
+
diff --git a/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/values.yaml b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/values.yaml
new file mode 100644
index 000000000..897397368
--- /dev/null
+++ b/charts/redhat/redhat/redhat-mysql-persistent/0.0.5/src/values.yaml
@@ -0,0 +1,9 @@
+database_service_name: mysql
+memory_limit: 512Mi
+mysql_database: testdb
+mysql_password: testp # TODO: must define a default value for .mysql_password'
+mysql_root_password: testur # TODO: must define a default value for .mysql_root_password'
+mysql_user: testu # TODO: must define a default value for .mysql_user'
+mysql_version: 8.0-el8
+namespace: openshift
+volume_capacity: 1Gi
diff --git a/charts/redhat/redhat/redhat-rhaap-portal/2.0.0/redhat-rhaap-portal-2.0.0.tgz b/charts/redhat/redhat/redhat-rhaap-portal/2.0.0/redhat-rhaap-portal-2.0.0.tgz
new file mode 100644
index 000000000..4b413f939
Binary files /dev/null and b/charts/redhat/redhat/redhat-rhaap-portal/2.0.0/redhat-rhaap-portal-2.0.0.tgz differ
diff --git a/charts/redhat/redhat/redhat-rhaap-portal/2.0.1/redhat-rhaap-portal-2.0.1.tgz b/charts/redhat/redhat/redhat-rhaap-portal/2.0.1/redhat-rhaap-portal-2.0.1.tgz
new file mode 100644
index 000000000..064b58424
Binary files /dev/null and b/charts/redhat/redhat/redhat-rhaap-portal/2.0.1/redhat-rhaap-portal-2.0.1.tgz differ
diff --git a/charts/redhat/redhat/redhat-rhaap-portal/2.0.2/redhat-rhaap-portal-2.0.2.tgz b/charts/redhat/redhat/redhat-rhaap-portal/2.0.2/redhat-rhaap-portal-2.0.2.tgz
new file mode 100644
index 000000000..aa89fd369
Binary files /dev/null and b/charts/redhat/redhat/redhat-rhaap-portal/2.0.2/redhat-rhaap-portal-2.0.2.tgz differ
diff --git a/charts/redhat/redhat/redhat-rhaap-portal/2.0.3/redhat-rhaap-portal-2.0.3.tgz b/charts/redhat/redhat/redhat-rhaap-portal/2.0.3/redhat-rhaap-portal-2.0.3.tgz
new file mode 100644
index 000000000..cff48803b
Binary files /dev/null and b/charts/redhat/redhat/redhat-rhaap-portal/2.0.3/redhat-rhaap-portal-2.0.3.tgz differ
diff --git a/charts/redhat/redhat/redhat-trusted-profile-analyzer/1.1.1/redhat-trusted-profile-analyzer-1.1.1.tgz b/charts/redhat/redhat/redhat-trusted-profile-analyzer/1.1.1/redhat-trusted-profile-analyzer-1.1.1.tgz
new file mode 100644
index 000000000..d5a2a84b6
Binary files /dev/null and b/charts/redhat/redhat/redhat-trusted-profile-analyzer/1.1.1/redhat-trusted-profile-analyzer-1.1.1.tgz differ
diff --git a/charts/redhat/redhat/redhat-trusted-profile-analyzer/1.1.1/report.yaml b/charts/redhat/redhat/redhat-trusted-profile-analyzer/1.1.1/report.yaml
new file mode 100644
index 000000000..1ebcd7853
--- /dev/null
+++ b/charts/redhat/redhat/redhat-trusted-profile-analyzer/1.1.1/report.yaml
@@ -0,0 +1,103 @@
+apiversion: v1
+kind: verify-report
+metadata:
+    tool:
+        verifier-version: 1.13.13
+        profile:
+            VendorType: redhat
+            version: v1.3
+        reportDigest: uint64:4352816472835522721
+        chart-uri: ./redhat-trusted-profile-analyzer-1.1.1.tgz
+        digests:
+            chart: sha256:99780754a7923938815dad479cd751deab6baecd4c08012b04cbbc838487d9ae
+            package: 6604314a484f4a86c0e6aa40a59a00c2f257c0eded39f5748ab4a81ebc6cc5a7
+        lastCertifiedTimestamp: "2025-09-10T18:30:22.718861+02:00"
+        testedOpenShiftVersion: "4.19"
+        supportedOpenShiftVersions: '>=4.12'
+        webCatalogOnly: false
+    chart:
+        name: redhat-trusted-profile-analyzer
+        home: https://access.redhat.com/products/red-hat-trusted-profile-analyzer
+        sources: []
+        version: 1.1.1
+        description: An Helm chart for deploying Red Hat Trusted Profile Analyzer (RHTPA)
+        keywords: []
+        maintainers:
+            - name: Red Hat
+              email: rhtpa-support@redhat.com
+              url: https://www.redhat.com
+        icon: data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgd2lkdGg9IjM4IiBoZWlnaHQ9IjM4IiB2aWV3Qm94PSIwIDAgMzggMzgiPjxkZWZzPjxzdHlsZT4uZHtmaWxsOiNlMDA7fS5le2ZpbGw6I2ZmZjt9LmZ7ZmlsbDojZTBlMGUwO308L3N0eWxlPjwvZGVmcz48ZyBpZD0iYSI+PHJlY3QgY2xhc3M9ImUiIHg9IjEiIHk9IjEiIHdpZHRoPSIzNiIgaGVpZ2h0PSIzNiIgcng9IjkiIHJ5PSI5Ii8+PHBhdGggY2xhc3M9ImYiIGQ9Im0yOCwyLjI1YzQuMjczNCwwLDcuNzUsMy40NzY2LDcuNzUsNy43NXYxOGMwLDQuMjczNC0zLjQ3NjYsNy43NS03Ljc1LDcuNzVIMTBjLTQuMjczNCwwLTcuNzUtMy40NzY2LTcuNzUtNy43NVYxMGMwLTQuMjczNCwzLjQ3NjYtNy43NSw3Ljc1LTcuNzVoMThtMC0xLjI1SDEwQzUuMDI5NCwxLDEsNS4wMjk0LDEsMTB2MThjMCw0Ljk3MDYsNC4wMjk0LDksOSw5aDE4YzQuOTcwNiwwLDktNC4wMjk0LDktOVYxMGMwLTQuOTcwNi00LjAyOTQtOS05LTloMFoiLz48L2c+PGcgaWQ9ImIiPjxwYXRoIGNsYXNzPSJkIiBkPSJtMjguNDQyNCwyNy41NTgxbC00LjgxODUtNC44MTg1Yy43MTM1LS42OTQ2LDEuMjc3Ni0xLjU1MjcsMS42MjMyLTIuNTMxNi4xMTUyLS4zMjUyLS4wNTU3LS42ODIxLS4zODA5LS43OTc0LS4zMjIzLS4xMTYyLS42ODI2LjA1NTItLjc5NjkuMzgxMy0uNzU3OCwyLjE0MzEtMi43OTQ5LDMuNTgzLTUuMDY5MywzLjU4My0yLjk2MzksMC01LjM3NS0yLjQxMTEtNS4zNzUtNS4zNzVzMi40MTExLTUuMzc1LDUuMzc1LTUuMzc1Yy4zNDQ3LDAsLjYyNS0uMjc5OC42MjUtLjYyNXMtLjI4MDMtLjYyNS0uNjI1LS42MjVjLTMuNjUzMywwLTYuNjI1LDIuOTcyMi02LjYyNSw2LjYyNXMyLjk3MTcsNi42MjUsNi42MjUsNi42MjVjMS4zMjUxLDAsMi41Nzc3LS40MDc0LDMuNjM2Mi0xLjEwNDVsNC45MjE0LDQuOTIxNGMuMTIyMS4xMjIxLjI4MjIuMTgzMS40NDI0LjE4MzFzLjMyMDMtLjA2MS40NDI0LS4xODMxYy4yNDMyLS4yNDQxLjI0MzItLjYzOTYsMC0uODgzOFoiLz48cGF0aCBkPSJtMjAuNDQyNCwyNy41NTgxbC0yLTJjLS4yNDQxLS4yNDQxLS42NDA2LS4yNDQxLS44ODQ4LDAtLjI0MzIuMjQ0MS0uMjQzMi42Mzk2LDAsLjg4MzhsLjkwNjIuOTA1OWMtNC45MTkxLS4yODA0LTguODM4OC00LjM1OTQtOC44Mzg4LTkuMzQ3OCwwLTUuMTY5NCw0LjIwNjEtOS4zNzUsOS4zNzUtOS4zNzUuMzQ0NywwLC42MjUtLjI3OTguNjI1LS42MjVzLS4yODAzLS42MjUtLjYyNS0uNjI1Yy01Ljg1ODQsMC0xMC42MjUsNC43NjY2LTEwLjYyNSwxMC42MjUsMCw1LjY5NDksNC41MDc3LDEwLjM0NDUsMTAuMTQwNiwxMC42MDA1bC0uOTU3OS45NTc2Yy0uMjQzMi4yNDQxLS4yNDMyLjYzOTYsMCwuODgzOC4xMjIxLjEyMjEuMjgyMi4xODMxLjQ0MjQuMTgzMXMuMzIwMy0uMDYxLjQ0MjQtLjE4MzFsMi0yYy4yNDMyLS4yNDQxLjI0MzItLjYzOTYsMC0uODgzOFoiLz48cGF0aCBkPSJtMjUuNSwxNy42MjVjLTIuMjc0NCwwLTQuMTI1LTEuODUwNi00LjEyNS00LjEyNXYtNC4wMjg4YzAtLjI5NDkuMjA2MS0uNTQ5OC40OTUxLS42MTEzbDMuNS0uNzQ0MWMuMDg1OS0uMDE4Ni4xNzM4LS4wMTg2LjI1OTgsMGwzLjUuNzQ0MWMuMjg5MS4wNjEuNDk1MS4zMTY0LjQ5NTEuNjExM3Y0LjAyODhjMCwyLjI3NDQtMS44NTA2LDQuMTI1LTQuMTI1LDQuMTI1Wm0tMi44NzUtNy42NDc5djMuNTIyOWMwLDEuNTg1NCwxLjI5LDIuODc1LDIuODc1LDIuODc1czIuODc1LTEuMjg5NiwyLjg3NS0yLjg3NXYtMy41MjI5bC0yLjg3NS0uNjEwOC0yLjg3NS42MTA4WiIvPjxwYXRoIGNsYXNzPSJkIiBkPSJtMjUsMTQuMzUyMWMtLjE2MDIsMC0uMzIwMy0uMDYxLS40NDI0LS4xODMxbC0xLTFjLS4yNDMyLS4yNDQxLS4yNDMyLS42Mzk2LDAtLjg4MzguMjQ0MS0uMjQ0MS42NDA2LS4yNDQxLjg4NDgsMGwuNTU3Ni41NTgxLDEuNTU3Ni0xLjU1ODFjLjI0NDEtLjI0NDEuNjQwNi0uMjQ0MS44ODQ4LDAsLjI0MzIuMjQ0MS4yNDMyLjYzOTYsMCwuODgzOGwtMiwyYy0uMTIyMS4xMjIxLS4yODIyLjE4MzEtLjQ0MjQuMTgzMVoiLz48L2c+PC9zdmc+
+        apiversion: v2
+        condition: ""
+        tags: ""
+        appversion: 2.1.1
+        deprecated: false
+        annotations:
+            charts.openshift.io/archs: x86_64
+            charts.openshift.io/name: Red Hat Trusted Profile Analyzer
+            charts.openshift.io/provider: Red Hat
+            charts.openshift.io/supportURL: https://access.redhat.com/support
+        kubeversion: ^1.25.0
+        dependencies: []
+        type: application
+    chart-overrides: ""
+results:
+    - check: v1.0/required-annotations-present
+      type: Mandatory
+      outcome: PASS
+      reason: All required annotations present
+    - check: v1.0/signature-is-valid
+      type: Mandatory
+      outcome: SKIPPED
+      reason: 'Chart is not signed : Signature verification not required'
+    - check: v1.0/chart-testing
+      type: Mandatory
+      outcome: PASS
+      reason: Chart tests have passed
+    - check: v1.0/contains-test
+      type: Mandatory
+      outcome: PASS
+      reason: Chart test files exist
+    - check: v1.1/has-kubeversion
+      type: Mandatory
+      outcome: PASS
+      reason: Kubernetes version specified
+    - check: v1.0/helm-lint
+      type: Mandatory
+      outcome: PASS
+      reason: Helm lint successful
+    - check: v1.1/images-are-certified
+      type: Mandatory
+      outcome: PASS
+      reason: |-
+        Image certification skipped : registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9@sha256:d5cf4a5bff94b59197f668a63d29591e3bc92ee89402edc70039e592d75cb84e
+        Image is Red Hat certified : registry.access.redhat.com/ubi9/ubi-minimal:latest
+    - check: v1.0/is-helm-v3
+      type: Mandatory
+      outcome: PASS
+      reason: API version is V2, used in Helm 3
+    - check: v1.0/not-contains-crds
+      type: Mandatory
+      outcome: PASS
+      reason: Chart does not contain CRDs
+    - check: v1.0/contains-values-schema
+      type: Mandatory
+      outcome: PASS
+      reason: Values schema file exist
+    - check: v1.0/contains-values
+      type: Mandatory
+      outcome: PASS
+      reason: Values file exist
+    - check: v1.0/has-readme
+      type: Mandatory
+      outcome: PASS
+      reason: Chart has a README
+    - check: v1.0/has-notes
+      type: Optional
+      outcome: PASS
+      reason: Chart does contain NOTES.txt
+    - check: v1.0/not-contain-csi-objects
+      type: Mandatory
+      outcome: PASS
+      reason: CSI objects do not exist
+