diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 74e11bf6..57ccc3ef 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,28 +1,69 @@
-name: Release Helm Charts
+name: Publish Helm Charts
+
+env:
+  DOCKER_REGISTRY: registry-1.docker.io
+  DOCKER_USER: instantlinux
+  GITHUB_REGISTRY: ghcr.io
+  CHART_DIR: k8s/helm
 
 on:
   push:
-    # branches: [gh-pages, master]
-    branches: [gh-pages, master, SYS-570_charts]
+    branches: [main]
+    paths:
+    - k8s/helm/**/Chart.yaml
+    - images/**/helm/Chart.yaml
 
 jobs:
-  release:
+  find-charts:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: List Chart.yaml Updates
+        id: set-matrix
+        run: |
+          CHANGED=$(git diff --name-only HEAD^ HEAD | \
+            grep -E "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \
+            awk '{sub(/\/[^/]+$/, ""); print}' | \
+            jq -R . | jq -s -c .)
+          echo "matrix={\"chart\":$CHANGED}" >> $GITHUB_OUTPUT
+
+  publish:
+    needs: find-charts
+    if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' &&
+            needs.find-charts.outputs.matrix != '' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.find-charts.outputs.matrix) }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v2.3.4
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
-    - name: Configure Git
+    - name: Install Helm
+      uses: azure/setup-helm@v4
+
+    - name: Log in to github OCI Registry
       run: |
-        git config user.name "$GITHUB_ACTOR"
-        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+        echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.GITHUB_REGISTRY }} --username ${{ github.actor }} --password-stdin
 
-    - name: Run chart-releaser
-      uses: helm/chart-releaser-action@v1.2.1
-      env:
-        CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-      with:
-        charts_dir: k8s/helm
-        config: .github/cr.yaml
+    - name: Log in to docker hub OCI Registry
+      run: |
+        echo "${{ secrets.DOCKER_TOKEN }}" | helm registry login ${{ env.DOCKER_REGISTRY }} --username ${{ env.DOCKER_USER }} --password-stdin
+
+    - name: Package and Push
+      run: |
+        helm dependency update "${{ matrix.chart }}"
+        helm package "${{ matrix.chart }}"
+        helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }}
+        helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts
diff --git a/README.md b/README.md
index 533cff98..c3d4a159 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ The cluster-deployment tools here include helm charts and ansible playbooks to s
 * Encryption for internal etcd
 * MFA using [Authelia](https://github.com/clems4ever/authelia) and Google Authenticator
 * Calico or flannel networking
-* ingress-nginx
+* Envoy API gateway
 * Local-volume sync
 * Garage object storage
 * Pod security policies
diff --git a/ansible/roles/network/defaults/main.yml b/ansible/roles/network/defaults/main.yml
index b6b3fdb3..2d8f3c82 100644
--- a/ansible/roles/network/defaults/main.yml
+++ b/ansible/roles/network/defaults/main.yml
@@ -1,4 +1,9 @@
 ---
+ca_trust_defaults:
+  path: /usr/local/share/ca-certificates
+  certificates: []
+ca_trust: "{{ ca_trust_defaults | combine(ca_trust_override) }}"
+
 kernel_modules:
   - ip_vs
 
diff --git a/ansible/roles/network/files/certs b/ansible/roles/network/files/certs
new file mode 120000
index 00000000..9ac8c04f
--- /dev/null
+++ b/ansible/roles/network/files/certs
@@ -0,0 +1 @@
+../../../../admin/tls/
\ No newline at end of file
diff --git a/ansible/roles/network/handlers/main.yml b/ansible/roles/network/handlers/main.yml
index e904614a..705b4242 100644
--- a/ansible/roles/network/handlers/main.yml
+++ b/ansible/roles/network/handlers/main.yml
@@ -13,6 +13,9 @@
     name: ssh
     state: restarted
 
+- name: Update CA certificates
+  command: update-ca-certificates
+
 - name: Restart tailscaled
   ansible.builtin.service:
     enabled: yes
diff --git a/ansible/roles/network/tasks/certificates.yml b/ansible/roles/network/tasks/certificates.yml
new file mode 100644
index 00000000..2e24aa3b
--- /dev/null
+++ b/ansible/roles/network/tasks/certificates.yml
@@ -0,0 +1,8 @@
+---
+- name: Add trusted root certificate(s)
+  ansible.builtin.copy:
+    dest: "{{ ca_trust.path }}/{{ item }}"
+    mode: 0400
+    src: certs/{{ item }}
+  with_items: "{{ ca_trust.certificates }}"
+  notify: Update CA certificates
diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml
index b0355e8a..4cc989f8 100644
--- a/ansible/roles/network/tasks/main.yml
+++ b/ansible/roles/network/tasks/main.yml
@@ -12,6 +12,7 @@
 - import_tasks: tailscale.yml
   when: network.tailscale.enabled
 
+- import_tasks: certificates.yml
 - import_tasks: kernel.yml
 - import_tasks: sshd.yml
 
diff --git a/images/mythtv-backend/helm/Chart.yaml b/images/mythtv-backend/helm/Chart.yaml
index 8e4be4ea..9bd07118 100644
--- a/images/mythtv-backend/helm/Chart.yaml
+++ b/images/mythtv-backend/helm/Chart.yaml
@@ -6,12 +6,12 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/mythtv/mythtv
 type: application
-version: 0.1.23
+version: 0.1.24
 appVersion: "36.0-fixes.202608221819.b6ed364d3f"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: data-sync
   version: 0.1.3
   repository: https://instantlinux.github.io/docker-tools
diff --git a/images/mythtv-backend/helm/templates/app.yaml b/images/mythtv-backend/helm/templates/app.yaml
index aeeec90a..a32c0217 100644
--- a/images/mythtv-backend/helm/templates/app.yaml
+++ b/images/mythtv-backend/helm/templates/app.yaml
@@ -1,3 +1,5 @@
+{{- include "chartlib.configmap" . }}
+---
 {{- include "chartlib.deployment" . }}
 ---
 {{- include "chartlib.hpa" . }}
@@ -6,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
diff --git a/images/mythtv-backend/helm/values.yaml b/images/mythtv-backend/helm/values.yaml
index 3644dbd8..10d9eb1e 100644
--- a/images/mythtv-backend/helm/values.yaml
+++ b/images/mythtv-backend/helm/values.yaml
@@ -89,6 +89,8 @@ authelia:
   fqdn: authtotp.example.com
   ip: 10.101.1.5
   path: /Myth/LoginUser
+gateway:
+  enabled: true
 ingress:
   # This ingress exposes your MythTV schedule and operational controls to
   #  the public Internet. Set up the admin user before enabling. See
diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml
index 95b2bf3a..72fef932 100644
--- a/images/squirrelmail/helm/Chart.yaml
+++ b/images/squirrelmail/helm/Chart.yaml
@@ -5,9 +5,9 @@ home: https://github.com/instantlinux/docker-tools
 sources:
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "latest"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
diff --git a/images/squirrelmail/helm/templates/app.yaml b/images/squirrelmail/helm/templates/app.yaml
index 5b83e9c4..a32c0217 100644
--- a/images/squirrelmail/helm/templates/app.yaml
+++ b/images/squirrelmail/helm/templates/app.yaml
@@ -1,3 +1,5 @@
+{{- include "chartlib.configmap" . }}
+---
 {{- include "chartlib.deployment" . }}
 ---
 {{- include "chartlib.hpa" . }}
@@ -6,6 +8,10 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
+---
+{{- include "chartlib.statefulset" . }}
diff --git a/images/squirrelmail/helm/values.yaml b/images/squirrelmail/helm/values.yaml
index 9950aaae..ee08370d 100644
--- a/images/squirrelmail/helm/values.yaml
+++ b/images/squirrelmail/helm/values.yaml
@@ -51,11 +51,5 @@ service:
 autoscaling:
   enabled: false
 
-authelia:
-  fqdn: authtotp.example.com
-  ip: 10.101.1.5
-  path: /src/login.php
-ingress:
-  enabled: true
-ingressTOTP:
+gateway:
   enabled: true
diff --git a/k8s/Makefile b/k8s/Makefile
index 83ea9dc3..1b41b5ef 100644
--- a/k8s/Makefile
+++ b/k8s/Makefile
@@ -91,15 +91,12 @@ INSTALL_YAML = $(basename $(wildcard install/*.yaml)) \
           $(addprefix imports/, $(IMPORTS))
 VOLUMES_YAML = $(basename $(wildcard volumes/*.yaml))
 
-install: install/admin-user cluster_network \
-	install/local-storage storage_localdefault imports \
-	install_imports namespace_config install/prometheus-rbac \
-	install/k8s-backup fluent-bit remote_volumes \
+install: install/admin-user cluster_network imports \
+	install_imports namespace_config fluent-bit remote_volumes \
 	sops data-sync-ssh persistent secrets install/ingress-nginx \
-	install/rsyslog-ext install/cert-manager
+	infra storage_localdefault
 
-namespace_config: install/namespace install/limits install/namespace-user \
-	secrets/regcred
+namespace_config: install/namespace install/namespace-user secrets/regcred
 
 untaint_master:
 	@echo -e '** Allowing workload on master risks admin-cert security compromise **\n'
@@ -176,15 +173,33 @@ include Makefile.sops
 # cert-manager
 ##########
 
-# Note - need both, to define the CRD and the ClusterIssuer resources
+# Note - need both, to define the CRD and the ClusterIssuer resources; define
+#     an override file for infra helm chart first and then:
 #   make imports/cert-manager
-#   make install/cert-manager
+#   make infra
 
 imports/cert-manager.yaml: imports/cert-manager-$(VERSION_CERT_MANAGER).yaml
 	ln -s $(notdir $<) $@
 imports/cert-manager-$(VERSION_CERT_MANAGER).yaml:
 	curl -sLo $@ https://github.com/cert-manager/cert-manager/releases/download/v$(VERSION_CERT_MANAGER)/cert-manager.yaml
 
+# Run this once after imports/cert-manager
+cert-manager-gateway: 
+	kubectl patch deployment cert-manager --context=sudo -n cert-manager --type='json' -p='[ { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--enable-gateway-api" }, { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--enable-gateway-api-listenerset" }, { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=ListenerSets=true" } ]'
+
+##########
+# envoy-gateway
+##########
+imports/envoy-gateway.yaml: imports/envoy-gateway-$(VERSION_ENVOY_GATEWAY).yaml
+	ln -s $(notdir $<) $@
+imports/envoy-gateway-$(VERSION_ENVOY_GATEWAY).yaml:
+	curl -sLo $@ https://github.com/envoyproxy/gateway/releases/download/v$(VERSION_ENVOY_GATEWAY)/install.yaml
+imports/envoy-gateway:: imports/envoy-gateway.yaml
+	@echo --$(NOTICE) $@ from server-side--
+	@SERVICE_NAME=$(@F) \
+	  envsubst < $@.yaml | kubectl $(ADMIN_CTX) $(ACTION) \
+	  --server-side --force-conflicts -f -
+
 ##########
 # node-local-dns
 ##########
diff --git a/k8s/Makefile.helm b/k8s/Makefile.helm
index 6c95a70f..b287e0a6 100644
--- a/k8s/Makefile.helm
+++ b/k8s/Makefile.helm
@@ -49,3 +49,5 @@ CHARTLOCK = $(addsuffix /Chart.lock, $(addprefix helm/, $(CHARTS))) \
 	  $(addsuffix /Chart.lock, $(addprefix helm/instances/, $(INSTANCES)))
 $(CHARTLOCK):
 	helm dependency update $(dir $@)
+
+infra: XARGS=--kube-context=sudo
diff --git a/k8s/Makefile.sops b/k8s/Makefile.sops
index b43b3447..d44ce115 100644
--- a/k8s/Makefile.sops
+++ b/k8s/Makefile.sops
@@ -5,6 +5,7 @@
 #    make gen_sops_gpg    - Set up local PGP private key
 #    make secrets/foo.yml - Create a new secret
 #    make secrets/foo     - (without .yml) Upload secret to k8s
+#    K8S_NAMESPACE=other CONTEXT_FLAG=--context=sudo make secrets/foo  - Upload to alt namespace
 #    sops secrets/foo.yml - Edit secret
 #
 # Note:
@@ -13,6 +14,7 @@
 .PHONY: sops gen_sops_gpg
 
 sops: /usr/local/bin/sops
+CONTEXT_FLAG ?=
 
 /usr/local/bin/sops:
 ifeq ($(shell uname -s),Darwin)
@@ -55,10 +57,7 @@ SECRETS = $(basename $(wildcard secrets/*.yml secrets/*/*.yml))
 secrets: $(SECRETS)
 $(SECRETS):
 	-sops -d $@.yml | envsubst | \
-	 kubectl create -n $(K8S_NAMESPACE) -f -
-
-# TODO does this need sudo?
-# kubectl create -n $(K8S_NAMESPACE) --context=sudo -f -
+	 kubectl create -n $(K8S_NAMESPACE) $(CONTEXT_FLAG) -f -
 
 secrets/%.yml secrets/*/%yml:
 	@echo Creating secret $(@F)
diff --git a/k8s/Makefile.vars b/k8s/Makefile.vars
index c572c6d5..b0f329c4 100644
--- a/k8s/Makefile.vars
+++ b/k8s/Makefile.vars
@@ -6,7 +6,6 @@
 
 export DOMAIN               ?= domain.com
 
-export CERT_MGR_EMAIL       ?= admin@$(DOMAIN)
 export CLUSTER_NETWORK      ?= flannel
 export DB_HOST              ?= db00.$(DOMAIN)
 export EDITOR               ?= vi
@@ -14,10 +13,6 @@ export K8S_NAMESPACE        ?= worker
 export K8S_NODES            ?= kube1.$(DOMAIN) kube2.$(DOMAIN) kube3.$(DOMAIN)
 export K8S_WORKER_COUNT     ?= 3
 export K8S_VOLUMES_PATH     ?= /var/lib/docker/k8s-volumes
-export LIMIT_CPU_DEFAULT    ?= 500m
-export LIMIT_CPU_REQUEST    ?= 50m
-export LIMIT_MEM_DEFAULT    ?= 256Mi
-export LIMIT_MEM_REQUEST    ?= 64Mi
 export LOG_NAMESPACE        ?= logging
 export LOG_TO_SPLUNK        ?=
 export MYTHTV_VOL_SIZE      ?= 400Gi
@@ -31,17 +26,16 @@ export POOL_SIZE_SMALL       = 500Mi
 export TZ                   ?= UTC
 
 # IP addresses - TODO replace static IPs with names, if practical
-export K8S_INGRESS_NGINX_IP ?= 10.101.1.2
 export AUTHELIA_IP          ?= 10.101.1.5
-export MONITOR_EXT_IP       ?= 192.168.1.20
-export RSYSLOGD_IP          ?= 10.101.1.40
 export COREDNS_IP           ?= 10.96.0.10
+export K8S_INGRESS_NGINX_IP ?= 10.101.1.2
+export MONITOR_EXT_IP       ?= 192.168.1.20
 export NODE_LOCAL_DNS_IP    ?= 169.254.0.10
+export RSYSLOGD_IP          ?= 10.101.1.40
 
-# Exposed nodePorts - install/ingress-nginx.yaml, install/rsyslog-ext.yaml
+# Exposed nodePorts - install/ingress-nginx.yaml
 export NODEPORT_HTTP         ?= 30080
 export NODEPORT_HTTPS        ?= 30443
-export NODEPORT_SYSLOG       ?= 30514
 
 # Ports configured in ingress-nginx.yaml
 export PORT_DOVECOT_IMAPD    ?= 843
diff --git a/k8s/Makefile.versions b/k8s/Makefile.versions
index ba9f8467..5f6c9f65 100644
--- a/k8s/Makefile.versions
+++ b/k8s/Makefile.versions
@@ -1,8 +1,9 @@
 # Third-party versions
-export VERSION_CERT_MANAGER   ?= 1.21.1
+export VERSION_CERT_MANAGER   ?= 1.21.2
 export VERSION_DEFAULTBACKEND ?= 1.5
+export VERSION_ENVOY_GATEWAY  ?= 1.9.1
 export VERSION_FLANNEL        ?= 0.28.9
-export VERSION_HELM           ?= 4.1.0
+export VERSION_HELM           ?= 4.3.0
 export VERSION_INGRESS_NGINX  ?= 1.15.1
 export VERSION_METRICS        ?= 2.18.0
 export VERSION_NODE_LOCAL_DNS ?= 1.36.4
diff --git a/k8s/README.md b/k8s/README.md
index 916a42e4..439f53db 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -33,7 +33,7 @@ kubeadm suite:
 * MFA using [Authelia](https://github.com/clems4ever/authelia) and Google Authenticator
 * Calico or flannel networking
 * Fluent Bit for container-log aggregation
-* ingress-nginx
+* Envoy API gateway
 * Local-volume sync
 * Automatic certificate issuing/renewal with Letsencrypt
 
@@ -229,11 +229,25 @@ Look in the k8s/install subdirectory for resources in namespace-user.yaml for ex
 
 ### Installation
 
-To configure k8s resources, invoke the following in this directory ([k8s](https://github.com/instantlinux/docker-tools/tree/main/k8s)):
+To configure k8s resources, first define a helm override file `infra.yaml` with content like these (define names to suit your environment):
+```
+authelia:
+  namespace: instantlinux
+certManager:
+  email: admin@ci.net
+  solvers:
+    dns01:
+      enabled: true
+      groupName: acme.ci.net
+gateway:
+  nodeport_http: 30180
+  nodeport_https: 30543
+```
+You'll need an account at letsencrypt, and a dns-apikey secret (with user and key) stored in cert-manager namespace. Invoke the following in this directory ([k8s](https://github.com/instantlinux/docker-tools/tree/main/k8s)):
 ```
 make install
 ```
-This will add flannel networking, an nginx ingress load-balancer,
+This will add flannel networking, an Envoy API gateway,
 helm and sops. Create directories for persistent volumes for each node,
 and optionally set node-affinity labels:
 ```
@@ -286,9 +300,9 @@ but gpg is suitable for bare-metal data center setups.
 ### Certificate Manager
 
 Cert-manager installation is part of the above _make install_; to
-start the issuer invoke:
+start the issuer (part of the `infra` helm chart here) invoke:
 ```
-CERT_MGR_EMAIL=<my email> make install/cert-manager
+CERT_MGR_EMAIL=<my email> make infra
 ```
 A lot of things have to be functioning before letsencrypt will issue certs: the [Let's Encrypt troubleshooting guide](https://cert-manager.io/docs/troubleshooting/acme/) is super-helpful.
 
diff --git a/k8s/helm/authelia/Chart.yaml b/k8s/helm/authelia/Chart.yaml
index 99eabe45..4fa6ae28 100644
--- a/k8s/helm/authelia/Chart.yaml
+++ b/k8s/helm/authelia/Chart.yaml
@@ -6,12 +6,12 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/authelia/authelia
 type: application
-version: 0.1.12
-appVersion: "4.39.20"
+version: 0.1.13
+appVersion: "4.39.25"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: ldap
   version: 0.1.0
   repository: file://subcharts/ldap
diff --git a/k8s/helm/authelia/templates/configmap.yaml b/k8s/helm/authelia/templates/configmap.yaml
index 246d24cc..5975f6d8 100644
--- a/k8s/helm/authelia/templates/configmap.yaml
+++ b/k8s/helm/authelia/templates/configmap.yaml
@@ -57,10 +57,11 @@ data:
 
     # Configuration of session cookies
     session:
-      expiration: {{ .Values.session.expiration }}
-      inactivity: {{ .Values.session.inactivity }}
-      # TODO this is deprecated with little info about how to fix it
-      domain: {{ .Values.session.domain }}
+      cookies:
+      - domain: {{ .Values.domain }}
+        authelia_url: https://{{ $.Values.tlsHostname }}
+        expiration: {{ .Values.session.expiration }}
+        inactivity: {{ .Values.session.inactivity }}
       redis:
         host: redis
         port: 6379
diff --git a/k8s/helm/chartlib/Chart.yaml b/k8s/helm/chartlib/Chart.yaml
index e28616a5..075d0e4d 100644
--- a/k8s/helm/chartlib/Chart.yaml
+++ b/k8s/helm/chartlib/Chart.yaml
@@ -4,4 +4,4 @@ description: Standard templates library
 sources:
 - https://github.com/instantlinux/docker-tools
 type: library
-version: 0.1.9
+version: 0.1.10
diff --git a/k8s/helm/chartlib/templates/_listener.yaml b/k8s/helm/chartlib/templates/_listener.yaml
new file mode 100644
index 00000000..8e437675
--- /dev/null
+++ b/k8s/helm/chartlib/templates/_listener.yaml
@@ -0,0 +1,144 @@
+{{- define "chartlib.listener" -}}
+{{- if hasKey .Values "gateway" }}
+{{- if or .Values.gateway.enabled (not (hasKey .Values "gateway.enabled")) }}
+{{- $fullName := include "local.fullname" . -}}
+{{- $svcPort := .Values.service.port | default (index .Values.service.ports 0).port -}}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: ListenerSet
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+  annotations:
+    {{- if hasKey .Values.gateway "annotations" }}
+    {{- toYaml .Values.gateway.annotations | nindent 4 }}
+    {{- else if .Values.gateway.external }}
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    {{- else }}
+    cert-manager.io/cluster-issuer: internal-ca-issuer
+    {{- end }}
+spec:
+  parentRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: {{ .Values.gateway.name | default "gateway-1" }}
+    {{- if hasKey .Values.gateway "namespace" }}
+    namespace: {{ .Values.gateway.namespace }}
+    {{- end }}
+  listeners:
+  {{- if hasKey .Values "tlsHostname" }}
+  - name: https
+    hostname: {{ .Values.tlsHostname }}
+    port: 443
+    protocol: HTTPS
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: tls-{{ $fullName }}
+  - name: http
+    hostname: {{ .Values.tlsHostname }}
+    port: 80
+    protocol: HTTP
+  {{- end }}
+  {{- if hasKey .Values.gateway "listeners" }}
+  {{- toYaml .Values.gateway.listeners | nindent 2 }}
+  {{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+spec:
+  parentRefs:
+  - kind: ListenerSet
+    name: {{ $fullName }}
+    sectionName: https
+  rules:
+  {{- if hasKey .Values.gateway "routeRules" }}
+  {{- toYaml .Values.gateway.routeRules | nindent 2 }}
+  {{- else }}
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: {{ $fullName }}
+      port: {{ $svcPort }}
+  {{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}-https-redirect
+spec:
+  parentRefs:
+  - kind: ListenerSet
+    name: {{ $fullName }}
+    sectionName: http
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 308
+{{- if and (hasKey .Values.gateway "totp") .Values.gateway.totp -}}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}-authelia
+spec:
+  parentRefs:
+  - kind: ListenerSet
+    name: {{ $fullName }}
+    sectionName: https
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: {{ .Values.authelia.path }}
+    backendRefs:
+    - name: {{ $fullName }}
+      port: {{ $svcPort }}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: {{ $fullName }}-totp
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    # kind: HTTPRoute
+    # name: {{ $fullName }}-authelia
+    kind: Gateway
+    name: {{ .Values.gateway.name | default "gateway-1" }}
+  extAuth:
+    failOpen: false
+    headersToExtAuth:
+    - accept
+    - authorization
+    - cookie
+    - location
+    - proxy-authorization
+    - x-forwarded-host
+    - x-forwarded-method
+    - x-forwarded-proto
+    - x-forwarded-uri
+    http:
+      backendRefs:
+      - name: {{ .Values.authelia.service | default "authelia" }}
+        port: {{ .Values.authelia.port | default 80 }}
+        {{- if hasKey .Values.authelia "namespace" }}
+        namespace: {{ .Values.authelia.namespace }}
+        {{- end }}
+      headersToBackend:
+      - Remote-Email
+      - Remote-Groups
+      - Remote-Name
+      - Remote-User
+      path: /api/authz/ext-authz/
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/k8s/helm/gitea/Chart.yaml b/k8s/helm/gitea/Chart.yaml
index f2067514..192ea3dc 100644
--- a/k8s/helm/gitea/Chart.yaml
+++ b/k8s/helm/gitea/Chart.yaml
@@ -6,9 +6,9 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/go-gitea/gitea
 type: application
-version: 0.1.10
-appVersion: 1.26.4-rootless
+version: 0.1.11
+appVersion: 1.27.3-rootless
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
diff --git a/k8s/helm/gitea/templates/app.yaml b/k8s/helm/gitea/templates/app.yaml
index 5a01911b..a32c0217 100644
--- a/k8s/helm/gitea/templates/app.yaml
+++ b/k8s/helm/gitea/templates/app.yaml
@@ -8,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
diff --git a/k8s/helm/gitea/values.yaml b/k8s/helm/gitea/values.yaml
index d07b0745..66892a07 100644
--- a/k8s/helm/gitea/values.yaml
+++ b/k8s/helm/gitea/values.yaml
@@ -99,11 +99,10 @@ service:
 autoscaling:
   enabled: false
 
-authelia:
-  fqdn: authtotp.example.com
-  ip: 10.101.1.5
-  path: /user/login
+gateway:
+  enabled: true
 ingress:
+  enabled: false
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     kubernetes.io/ingress.class: nginx
diff --git a/k8s/helm/grafana/Chart.yaml b/k8s/helm/grafana/Chart.yaml
index 4b592a6d..b3bb6ebe 100644
--- a/k8s/helm/grafana/Chart.yaml
+++ b/k8s/helm/grafana/Chart.yaml
@@ -6,13 +6,13 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/grafana/grafana
 type: application
-version: 0.1.5
+version: 0.1.6
 # Reminder, update subchart tags in values.yaml
 appVersion: 13.0.6
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: prometheus
   version: 0.1.4
   repository: file://subcharts/prometheus
diff --git a/k8s/helm/grafana/templates/app.yaml b/k8s/helm/grafana/templates/app.yaml
index 5a01911b..a32c0217 100644
--- a/k8s/helm/grafana/templates/app.yaml
+++ b/k8s/helm/grafana/templates/app.yaml
@@ -8,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
diff --git a/k8s/helm/grafana/values.yaml b/k8s/helm/grafana/values.yaml
index 8363e28e..09640acb 100644
--- a/k8s/helm/grafana/values.yaml
+++ b/k8s/helm/grafana/values.yaml
@@ -85,13 +85,16 @@ authelia:
   fqdn: authtotp.example.com
   ip: 10.101.1.5
   path: /login
+gateway:
+  enabled: true
 ingress:
+  enabled: false
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     kubernetes.io/ingress.class: nginx
     nginx.ingress.kubernetes.io/enable-access-log: "false"
 ingressTOTP:
-  enabled: true
+  enabled: false
 
 # Subchart parameters
 prometheus:
diff --git a/k8s/helm/guacamole/Chart.yaml b/k8s/helm/guacamole/Chart.yaml
index dc56b7a8..2bc2fadf 100644
--- a/k8s/helm/guacamole/Chart.yaml
+++ b/k8s/helm/guacamole/Chart.yaml
@@ -13,10 +13,10 @@ version: 0.1.6
 appVersion: "1.6.0"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: guacamole-server
-  version: 0.1.5
+  version: 0.1.6
   repository: file://subcharts/guacamole-server
 - name: guacd
   version: 0.1.5
diff --git a/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml b/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml
index f5b332f5..2f04c49b 100644
--- a/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml
+++ b/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml
@@ -6,7 +6,7 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/apache/guacamole-server
 type: application
-version: 0.1.5
+version: 0.1.6
 appVersion: "1.6.0"
 dependencies:
 - name: chartlib
diff --git a/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml b/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml
index 5a01911b..a32c0217 100644
--- a/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml
+++ b/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml
@@ -8,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
diff --git a/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml b/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml
index aed5ddc6..e354b69f 100644
--- a/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml
+++ b/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml
@@ -23,13 +23,24 @@ service:
   type: ClusterIP
 autoscaling:
   enabled: false
-ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/app-root: /guacamole
-    nginx.ingress.kubernetes.io/proxy-buffering: "off"
-    nginx.ingress.kubernetes.io/enable-access-log: "false"
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      proxy_set_header Connection $http_connection;
-      proxy_set_header Upgrade $http_upgrade;
+gateway:
+  enabled: true
+  routeRules:
+  - backendRefs:
+    - name: guacamole-guacamole-server
+      port: 80
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+  - filters:
+    - requestRedirect:
+        path:
+          replaceFullPath: /guacamole
+          type: ReplaceFullPath
+        statusCode: 302
+      type: RequestRedirect
+    matches:
+    - path:
+        type: Exact
+        value: /
diff --git a/k8s/helm/infra/.helmignore b/k8s/helm/infra/.helmignore
new file mode 100644
index 00000000..839de881
--- /dev/null
+++ b/k8s/helm/infra/.helmignore
@@ -0,0 +1,2 @@
+*~
+.git
diff --git a/k8s/helm/infra/Chart.yaml b/k8s/helm/infra/Chart.yaml
new file mode 100644
index 00000000..bff29269
--- /dev/null
+++ b/k8s/helm/infra/Chart.yaml
@@ -0,0 +1,13 @@
+apiVersion: v2
+name: infra
+description: Miscellaneous K8S infra resource definitions
+home: https://github.com/instantlinux/docker-tools
+sources:
+- https://github.com/instantlinux/docker-tools
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+dependencies:
+- name: chartlib
+  version: 0.1.8
+  repository: https://instantlinux.github.io/docker-tools
diff --git a/k8s/helm/infra/templates/NOTES.txt b/k8s/helm/infra/templates/NOTES.txt
new file mode 100644
index 00000000..62ea3f4b
--- /dev/null
+++ b/k8s/helm/infra/templates/NOTES.txt
@@ -0,0 +1,28 @@
+{{- if hasKey .Values "service" }}
+{{- if or .Values.service.enabled (not (hasKey .Values.service "enabled")) }}
+1. Get the application URL by running these commands:
+{{- if hasKey .Values "ingress" }}
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "local.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "local.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "local.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "local.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/k8s/helm/infra/templates/cert-manager.yaml b/k8s/helm/infra/templates/cert-manager.yaml
new file mode 100644
index 00000000..3ef84c83
--- /dev/null
+++ b/k8s/helm/infra/templates/cert-manager.yaml
@@ -0,0 +1,90 @@
+{{- if hasKey .Values.certManager.issuer "staging" }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.certManager.issuer.staging }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: {{ .Values.certManager.email }}
+    privateKeySecretRef:
+      name: {{ .Values.certManager.issuer.staging }}
+    solvers:
+    {{- range .Values.certManager.solvers }}
+    {{- if hasKey . "enabled" | ternary .enabled true }}
+    {{- if eq .solver "http01" }}
+    - http01:
+        ingress:
+          class: nginx
+    {{- end }}
+    {{- end }}
+    {{- end }}
+{{- end }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.certManager.issuer.prod }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: {{ .Values.certManager.email }}
+    privateKeySecretRef:
+      name: {{ .Values.certManager.issuer.prod }}
+    solvers:
+    {{- range .Values.certManager.solvers }}
+    {{- if hasKey . "enabled" | ternary .enabled true }}
+    {{- if eq .solver "http01" }}
+    - http01:
+        ingress:
+          class: nginx
+    {{- end }}
+    {{- end }}
+    {{- end }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: internal-root-ca-issuer
+  namespace: cert-manager
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-root-ca
+  namespace: cert-manager
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  isCA: true
+  commonName: internal-root-ca
+  duration: {{ .Values.certManager.internalCA.rootCert.duration }}
+  issuerRef:
+    name: internal-root-ca-issuer
+    kind: Issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  renewBefore: {{ .Values.certManager.internalCA.rootCert.renewBefore }}
+  secretName: internal-root-cert
+  subject:
+    {{- toYaml .Values.certManager.internalCA.subject | nindent 4 }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: internal-ca-issuer
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  ca:
+    secretName: internal-root-cert
diff --git a/k8s/helm/infra/templates/gateway.yaml b/k8s/helm/infra/templates/gateway.yaml
new file mode 100644
index 00000000..3ff3f699
--- /dev/null
+++ b/k8s/helm/infra/templates/gateway.yaml
@@ -0,0 +1,93 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: envoy-class
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: {{ .Values.gateway.config }}
+    namespace: {{ .Values.gateway.crdNamespace }}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: {{ .Values.gateway.config }}
+  namespace: {{ .Values.gateway.crdNamespace }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        type: NodePort
+        patch:
+          type: StrategicMerge
+          value:
+            spec:
+              ports:
+                - name: http
+                  port: 80
+                  protocol: TCP
+                  nodePort: {{ .Values.gateway.nodeport_http }}
+                - name: https
+                  port: 443
+                  protocol: TCP
+                  nodePort: {{ .Values.gateway.nodeport_https }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: {{ .Values.gateway.name }}
+  namespace: {{ .Values.namespace }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  gatewayClassName: envoy-class
+  allowedListeners:
+    namespaces:
+      from: Selector
+      selector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ .Values.namespace }}
+  listeners:
+  # at least one dummy listener is needed; here we also add support for
+  # TCP listeners; all http listeners are defined with ListenerSets
+  {{- if hasKey .Values.gateway "listeners" }}
+  {{- range .Values.gateway.listeners }}
+  - name: {{ .name }}
+    protocol: TCP
+    port: {{ .port }}
+    allowedRoutes:
+      kinds:
+      - kind: TCPRoute
+  {{- end }}
+  {{- else }}
+  - name: dummy
+    protocol: HTTP
+    port: 80
+  {{- end }}
+{{- if ne .Values.namespace .Values.authelia.namespace }}
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: envoy-authelia-integration
+  namespace: {{ .Values.authelia.namespace }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  from:
+  - group: gateway.envoyproxy.io
+    kind: SecurityPolicy
+    namespace: {{ .Values.infra.namespace }}
+  to:
+  - group: ""
+    kind: Service
+    name: {{ .Values.authelia.service | default "authelia" }}
+{{- end }}
diff --git a/k8s/install/k8s-backup.yaml b/k8s/helm/infra/templates/k8s-backup.yaml
similarity index 87%
rename from k8s/install/k8s-backup.yaml
rename to k8s/helm/infra/templates/k8s-backup.yaml
index 79c5e748..b35f5636 100644
--- a/k8s/install/k8s-backup.yaml
+++ b/k8s/helm/infra/templates/k8s-backup.yaml
@@ -5,8 +5,7 @@ metadata:
   name: backup
   namespace: kube-system
 spec:
-  # 4:10am PST is 12:10pm UTC - k8s cron only supports UTC
-  schedule: "10 12 * * *"
+  schedule: {{ .Values.k8sBackup.schedule }}
   jobTemplate:
     spec:
       template:
@@ -14,7 +13,7 @@ spec:
           containers:
           - name: backup
             # Same image as in /etc/kubernetes/manifests/etcd.yaml
-            image: registry.k8s.io/etcd:$VERSION_ETCD
+            image: registry.k8s.io/etcd:{{ .Values.k8sBackup.etcdVersion }}
             command: ["/bin/sh"]
             args: ["-c", "etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key snapshot save /backup/etcd-snapshot-$(printf '%(%y-%m-%d_%T)T').db"]
             env:
@@ -40,4 +39,4 @@ spec:
               path: /etc/kubernetes/pki/etcd
               type: Directory
           - name: backup
-            hostPath: { path: /var/backup/k8s }
+            hostPath: { path: {{ .Values.k8sBackup.destPath }} }
diff --git a/k8s/helm/infra/templates/limits.yaml b/k8s/helm/infra/templates/limits.yaml
new file mode 100644
index 00000000..762918ef
--- /dev/null
+++ b/k8s/helm/infra/templates/limits.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: mem-limit-range
+  namespace: {{ .Values.namespace }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  limits:
+  - default:
+      memory: {{ .Values.limits.mem.default }}
+    defaultRequest:
+      memory: {{ .Values.limits.mem.request }}
+    type: Container
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: cpu-limit-range
+  namespace: {{ .Values.namespace }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  limits:
+  - default:
+      cpu: {{ .Values.limits.cpu.default }}
+    defaultRequest:
+      cpu: {{ .Values.limits.cpu.request }}
+    type: Container
diff --git a/k8s/helm/infra/templates/listeners.yaml b/k8s/helm/infra/templates/listeners.yaml
new file mode 100644
index 00000000..14a33aad
--- /dev/null
+++ b/k8s/helm/infra/templates/listeners.yaml
@@ -0,0 +1,18 @@
+{{- if hasKey .Values.gateway "listeners" }}
+{{- range .Values.gateway.listeners }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  name: {{ .name }}
+  namespace: {{ $.Values.namespace }}
+spec:
+  parentRefs:
+  - name: {{ $.Values.gateway.name }}
+    sectionName: {{ .name }}
+  rules:
+  - backendRefs:
+    - name: {{ .service }}
+      port: {{ .port }}
+{{- end }}
+{{- end }}
diff --git a/k8s/install/local-storage.yaml b/k8s/helm/infra/templates/local-storage.yaml
similarity index 82%
rename from k8s/install/local-storage.yaml
rename to k8s/helm/infra/templates/local-storage.yaml
index b2050966..c239d2ac 100644
--- a/k8s/install/local-storage.yaml
+++ b/k8s/helm/infra/templates/local-storage.yaml
@@ -5,6 +5,8 @@ metadata:
   annotations:
     storageclass.kubernetes.io/is-default-class: "true"
   name: local-storage
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
 allowVolumeExpansion: false
 provisioner: kubernetes.io/no-provisioner
 volumeBindingMode: WaitForFirstConsumer
diff --git a/k8s/install/prometheus-rbac.yaml b/k8s/helm/infra/templates/prometheus-rbac.yaml
similarity index 62%
rename from k8s/install/prometheus-rbac.yaml
rename to k8s/helm/infra/templates/prometheus-rbac.yaml
index c02e37fc..6844d14f 100644
--- a/k8s/install/prometheus-rbac.yaml
+++ b/k8s/helm/infra/templates/prometheus-rbac.yaml
@@ -2,20 +2,24 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: $K8S_NAMESPACE:prometheus-scraper-binding
+  name: {{ .Values.namespace }}:prometheus-scraper-binding
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: $K8S_NAMESPACE:prometheus-scraper
+  name: {{ .Values.namespace }}:prometheus-scraper
 subjects:
 - kind: ServiceAccount
   name: grafana-prometheus
-  namespace: $K8S_NAMESPACE
+  namespace: {{ .Values.namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: $K8S_NAMESPACE:prometheus-scraper
+  name: {{ .Values.namespace }}:prometheus-scraper
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
 rules:
 - apiGroups: [""]
   resources:
diff --git a/k8s/install/rsyslog-ext.yaml b/k8s/helm/infra/templates/rsyslog-ext.yaml
similarity index 52%
rename from k8s/install/rsyslog-ext.yaml
rename to k8s/helm/infra/templates/rsyslog-ext.yaml
index 501c01eb..3988c9ac 100644
--- a/k8s/install/rsyslog-ext.yaml
+++ b/k8s/helm/infra/templates/rsyslog-ext.yaml
@@ -4,11 +4,13 @@ apiVersion: v1
 kind: Service
 metadata:
   name: rsyslogd-external
-  namespace: $K8S_NAMESPACE
+  namespace: {{ .Values.namespace }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
 spec:
   type: NodePort
   ports:
-  - { port: 514, nodePort: $NODEPORT_SYSLOG, targetPort: 514, name: rsyslogd }
+  - { port: 514, nodePort: {{ .Values.rsyslogExt.nodePort }}, targetPort: 514, name: rsyslogd }
   selector:
     app.kubernetes.io/name: rsyslogd
   sessionAffinity: ClientIP
diff --git a/k8s/helm/infra/templates/tests/test-connection.yaml b/k8s/helm/infra/templates/tests/test-connection.yaml
new file mode 100644
index 00000000..ae159a4f
--- /dev/null
+++ b/k8s/helm/infra/templates/tests/test-connection.yaml
@@ -0,0 +1,17 @@
+{{- if hasKey .Values "service" }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "local.fullname" . }}-test-connection"
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "local.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never
+{{- end }}
diff --git a/k8s/helm/infra/values.yaml b/k8s/helm/infra/values.yaml
new file mode 100644
index 00000000..d6a34463
--- /dev/null
+++ b/k8s/helm/infra/values.yaml
@@ -0,0 +1,53 @@
+# Default values for infra.
+namespace: default
+certManager:
+  email: admin@example.com
+  issuer:
+    prod: letsencrypt-prod
+    # Add this override for testing
+    # staging: letsencrypt-staging
+  internalCA:
+    rootCert:
+      duration: 43800h
+      renewBefore: 2160h
+    commonName: Internal Root
+    subject:
+      countries: [ US ]
+      localities: [ San Francisco ]
+      organizations: [ Example Inc ]
+      organizationalUnits: [ ]
+      provinces: [ California ]
+  solvers:
+  - solver: http01
+    enabled: true
+gateway:
+  config: envoy-config
+  name: gateway-1
+  crdNamespace: envoy-gateway-system
+  listeners: []
+k8sBackup:
+  destPath: /var/backup/k8s
+  etcdVersion: 3.5.15-0
+  # 4:10am PST is 12:10pm UTC - k8s cron only supports UTC
+  schedule: "10 12 * * *"
+limits:
+  cpu:
+    default: 500m
+    request: 50m
+  mem:
+    default: 256Mi
+    request: 64Mi
+rsyslogExt:
+  nodePort: 30514
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  enabled: true
+  name: example-privileged
+service:
+  clusterIP: 10.101.1.19
+  ports: [ port: 2379 ]
+  type: ClusterIP
+autoscaling:
+  enabled: false
diff --git a/k8s/helm/jira/Chart.yaml b/k8s/helm/jira/Chart.yaml
index 0a81d2fd..89490a72 100644
--- a/k8s/helm/jira/Chart.yaml
+++ b/k8s/helm/jira/Chart.yaml
@@ -6,12 +6,12 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://hub.docker.com/r/atlassian/jira-core
 type: application
-version: 0.1.6
+version: 0.1.7
 appVersion: "9.12.1"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: mariadb
   version: 0.1.0
   repository: file://subcharts/mariadb
diff --git a/k8s/helm/jira/templates/app.yaml b/k8s/helm/jira/templates/app.yaml
index 5a01911b..a32c0217 100644
--- a/k8s/helm/jira/templates/app.yaml
+++ b/k8s/helm/jira/templates/app.yaml
@@ -8,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
diff --git a/k8s/helm/jira/values.yaml b/k8s/helm/jira/values.yaml
index 8b000d26..cc34a42d 100644
--- a/k8s/helm/jira/values.yaml
+++ b/k8s/helm/jira/values.yaml
@@ -75,13 +75,9 @@ authelia:
   fqdn: authtotp.example.com
   ip: 10.101.1.5
   path: /login.jsp
-ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/enable-access-log: "false"
-ingressTOTP:
+gateway:
   enabled: true
+  totp: false
 
 mariadb:
   enabled: false
diff --git a/k8s/helm/nexus/Chart.yaml b/k8s/helm/nexus/Chart.yaml
index 452ed805..065cab43 100644
--- a/k8s/helm/nexus/Chart.yaml
+++ b/k8s/helm/nexus/Chart.yaml
@@ -5,12 +5,12 @@ home: https://github.com/instantlinux/docker-tools
 sources:
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.14
-appVersion: "3.93.2"
+version: 0.1.16
+appVersion: "3.96.1"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: postgres
   version: 0.1.0
   repository: file://subcharts/postgres
diff --git a/k8s/helm/nexus/templates/app.yaml b/k8s/helm/nexus/templates/app.yaml
index b925dd1f..a32c0217 100644
--- a/k8s/helm/nexus/templates/app.yaml
+++ b/k8s/helm/nexus/templates/app.yaml
@@ -8,6 +8,10 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
+---
+{{- include "chartlib.statefulset" . }}
diff --git a/k8s/helm/nexus/values.yaml b/k8s/helm/nexus/values.yaml
index 21cef42d..4516bc3e 100644
--- a/k8s/helm/nexus/values.yaml
+++ b/k8s/helm/nexus/values.yaml
@@ -2,6 +2,7 @@
 
 autheliaIP: 10.0.10.10
 domain: example.com
+tlsHostname: nexus.example.com
 deployment:
   # Notes:
   #   port 1234 provides an h2 console, if configured
@@ -63,8 +64,31 @@ service:
   - { port: 80, targetPort: 8081, name: nexus }
   - { port: 5001, targetPort: 5000, name: registry }
 
-ingress:
+gateway:
   enabled: true
+  routeRules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: nexus
+      port: 80
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: nexus
+      port: 5001
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /v2/
+ingress:
+  enabled: false
   className: ""
   annotations:
     kubernetes.io/ingress.class: nginx
diff --git a/k8s/helm/splunk/Chart.yaml b/k8s/helm/splunk/Chart.yaml
index 83e8d5e9..e8b2ed8f 100644
--- a/k8s/helm/splunk/Chart.yaml
+++ b/k8s/helm/splunk/Chart.yaml
@@ -15,9 +15,9 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://hub.docker.com/r/splunk/splunk
 type: application
-version: 0.1.18
+version: 0.1.19
 appVersion: "10.4.1"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
diff --git a/k8s/helm/splunk/templates/app.yaml b/k8s/helm/splunk/templates/app.yaml
index aeeec90a..a32c0217 100644
--- a/k8s/helm/splunk/templates/app.yaml
+++ b/k8s/helm/splunk/templates/app.yaml
@@ -1,3 +1,5 @@
+{{- include "chartlib.configmap" . }}
+---
 {{- include "chartlib.deployment" . }}
 ---
 {{- include "chartlib.hpa" . }}
@@ -6,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
diff --git a/k8s/helm/splunk/templates/security.yaml b/k8s/helm/splunk/templates/security.yaml
new file mode 100644
index 00000000..3aa3cd52
--- /dev/null
+++ b/k8s/helm/splunk/templates/security.yaml
@@ -0,0 +1,17 @@
+{{- $fullName := include "local.fullname" . -}}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "local.labels" . | nindent 4 }}
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: {{ $fullName }}
+  basicAuth:
+    users:
+      name: splunk-auth
+
diff --git a/k8s/helm/splunk/values.yaml b/k8s/helm/splunk/values.yaml
index 9fb56fc8..4d60ec14 100644
--- a/k8s/helm/splunk/values.yaml
+++ b/k8s/helm/splunk/values.yaml
@@ -79,11 +79,21 @@ authelia:
   fqdn: authtotp.example.com
   ip: 10.101.1.5
   path: /en-US/account/login
-ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/auth-type: basic
-    nginx.ingress.kubernetes.io/auth-secret: splunk-auth
-ingressTOTP:
+gateway:
   enabled: true
+  totp: false
+  routeRules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: splunk
+      port: 80
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+    sessionPersistence:
+      absoluteTimeout: 30m
+      type: Header
+      sessionName: Authorization
diff --git a/k8s/install/cert-manager.yaml b/k8s/install/cert-manager.yaml
deleted file mode 100644
index 255d3805..00000000
--- a/k8s/install/cert-manager.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    email: $CERT_MGR_EMAIL
-    privateKeySecretRef:
-      name: letsencrypt-staging
-    solvers:
-    - http01:
-        ingress:
-          class: nginx
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-prod
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: $CERT_MGR_EMAIL
-    privateKeySecretRef:
-      name: letsencrypt-prod
-    solvers:
-    - http01:
-        ingress:
-          class: nginx
diff --git a/k8s/install/limits.yaml b/k8s/install/limits.yaml
deleted file mode 100644
index 89e6d21f..00000000
--- a/k8s/install/limits.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-apiVersion: v1
-kind: LimitRange
-metadata:
-  name: mem-limit-range
-  namespace: $K8S_NAMESPACE
-spec:
-  limits:
-  - default:
-      memory: $LIMIT_MEM_DEFAULT
-    defaultRequest:
-      memory: $LIMIT_MEM_REQUEST
-    type: Container
----
-apiVersion: v1
-kind: LimitRange
-metadata:
-  name: cpu-limit-range
-  namespace: $K8S_NAMESPACE
-spec:
-  limits:
-  - default:
-      cpu: $LIMIT_CPU_DEFAULT
-    defaultRequest:
-      cpu: $LIMIT_CPU_REQUEST
-    type: Container
diff --git a/k8s/install/namespace-user.yaml b/k8s/install/namespace-user.yaml
index 30eb96ed..c966334f 100644
--- a/k8s/install/namespace-user.yaml
+++ b/k8s/install/namespace-user.yaml
@@ -58,11 +58,32 @@ rules:
 - apiGroups: [cert-manager.io]
   resources:
   - certificates
+  - certificaterequests
+  verbs: [get, list]
+- apiGroups: [acme.cert-manager.io]
+  resources:
+  - challenges
+  - orders
   verbs: [get, list]
 - apiGroups: [networking.k8s.io]
   resources:
   - ingresses
   verbs: ["*"]
+- apiGroups: [gateway.envoyproxy.io]
+  resources:
+  - securitypolicies
+  verbs: ["*"]
+- apiGroups: [gateway.networking.k8s.io]
+  resources:
+  - gateways
+  - httproutes
+  - listenersets
+  - tcproutes
+  verbs: ["*"]
+- apiGroups: [gateway.networking.k8s.io]
+  resources:
+  - gatewayclasses
+  verbs: [get, list, watch]
 - apiGroups: [rbac.authorization.k8s.io]
   resources:
   - rolebindings