diff --git a/README.md b/README.md
index 5ab664a6..23b398d9 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ This template implements Flux in a way that promotes legibility and ease of use
 
 Before we get started everything below must be taken into consideration, you must...
 
-- [ ] have some experience with 3 of the following: Git/SCM, containers, networking or programming.
+- [ ] have some experience with 3 of the following: Git/SCM, containers, networking or scripting.
 - [ ] bring a **positive attitude** and be ready to learn and fail a lot. _The more you fail, the more you can learn from._
 - [ ] run the cluster on bare metal machines or VMs within your home network — **this is NOT designed for cloud environments**.
 - [ ] have Debian 12 freshly installed on 1 or more AMD64/ARM64 bare metal machines or VMs. Each machine will be either a **control node** or a **worker node** in your cluster.
diff --git a/bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2
index 12ac5603..efb42acd 100644
--- a/bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: csi-driver-nfs
-  namespace: kube-system
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 b/bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2
index 53906e15..70fd2032 100644
--- a/bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
   - ./helmrelease.yaml
   - ./storageclass.yaml
diff --git a/bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2 b/bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2
index 18e933c0..b451eea2 100644
--- a/bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2
+++ b/bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-csi-driver-nfs
+  name: &app csi-driver-nfs
   namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/csi-driver-nfs/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2
index 1bbae983..bcd52de3 100644
--- a/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: discord-template-notifier
-  namespace: default
 spec:
   interval: 15m
   chart:
diff --git a/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2
index 9444f7fa..95bf4747 100644
--- a/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: default
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2
index 837d614d..12759d18 100644
--- a/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2
+++ b/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: discord-template-notifier-secret
-  namespace: default
 type: Opaque
 stringData:
   config.toml: |-
diff --git a/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2
index 55e19556..0b333f3c 100644
--- a/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2
+++ b/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-discord-template-notifier
+  name: &app discord-template-notifier
   namespace: flux-system
 spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/default/discord-template-notifier/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2
index f6cdc235..63066e2f 100644
--- a/bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: grafana
-  namespace: monitoring
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/addons/grafana/app/kustomization.yaml.j2 b/bootstrap/templates/addons/grafana/app/kustomization.yaml.j2
index b80069e7..95bf4747 100644
--- a/bootstrap/templates/addons/grafana/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/grafana/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: monitoring
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2 b/bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2
index f458b9ce..c776a17c 100644
--- a/bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2
+++ b/bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: grafana-admin-secret
-  namespace: monitoring
 stringData:
   admin-user: admin
   admin-password: "{{ grafana.password }}"
diff --git a/bootstrap/templates/addons/grafana/ks.yaml.j2 b/bootstrap/templates/addons/grafana/ks.yaml.j2
index c115caa8..21e71d4a 100644
--- a/bootstrap/templates/addons/grafana/ks.yaml.j2
+++ b/bootstrap/templates/addons/grafana/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-grafana
+  name: &app grafana
   namespace: flux-system
 spec:
+  targetNamespace: monitoring
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/monitoring/grafana/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/hajimari/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/hajimari/app/helmrelease.yaml.j2
index d1b4de80..c35dbd27 100644
--- a/bootstrap/templates/addons/hajimari/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/hajimari/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: hajimari
-  namespace: default
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/addons/hajimari/app/kustomization.yaml.j2 b/bootstrap/templates/addons/hajimari/app/kustomization.yaml.j2
index c0cd2183..5dd7baca 100644
--- a/bootstrap/templates/addons/hajimari/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/hajimari/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: default
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/addons/hajimari/ks.yaml.j2 b/bootstrap/templates/addons/hajimari/ks.yaml.j2
index 1fe9bdee..95582292 100644
--- a/bootstrap/templates/addons/hajimari/ks.yaml.j2
+++ b/bootstrap/templates/addons/hajimari/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-hajimari
+  name: &app hajimari
   namespace: flux-system
 spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/default/hajimari/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
index b96289c6..4588583b 100644
--- a/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: kube-prometheus-stack
-  namespace: monitoring
 spec:
   interval: 30m
   timeout: 15m
diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2
index e022d5a4..60a40edc 100644
--- a/bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2
+++ b/bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2
@@ -4,7 +4,6 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kube-prometheus-stack-values
-  namespace: monitoring
 data:
   values.yaml: |
     crds:
diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2
index 56c7f044..dc39651b 100644
--- a/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: monitoring
 resources:
   - ./helmvalues.yaml
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2
index 74c53588..0d66c3fc 100644
--- a/bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2
+++ b/bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-kube-prometheus-stack
+  name: &app kube-prometheus-stack
   namespace: flux-system
 spec:
+  targetNamespace: monitoring
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/monitoring/kube-prometheus-stack/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2
index 7b6dab41..2ea7a893 100644
--- a/bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: kubernetes-dashboard
-  namespace: monitoring
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2 b/bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2
index f3f3cf60..b5b97586 100644
--- a/bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: monitoring
 resources:
   - ./rbac.yaml
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2 b/bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2
index 4aecb438..01b56df0 100644
--- a/bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2
+++ b/bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2
@@ -5,7 +5,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: kubernetes-dashboard
-  namespace: monitoring
   labels:
     app.kubernetes.io/managed-by: Helm
   annotations:
@@ -19,7 +18,6 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: kubernetes-dashboard
-  namespace: monitoring
   labels:
     app.kubernetes.io/managed-by: Helm
   annotations:
diff --git a/bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2 b/bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2
index 2220146c..4ee53e92 100644
--- a/bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2
+++ b/bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2
@@ -2,12 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-kubernetes-dashboard
+  name: &app kubernetes-dashboard
   namespace: flux-system
 spec:
+  targetNamespace: monitoring
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-cert-manager
-    - name: cluster-apps-metrics-server
+    - name: cert-manager
+    - name: metrics-server
   path: ./kubernetes/apps/monitoring/kubernetes-dashboard/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2
index e4ff6191..6f5c48fd 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-system-upgrade-controller
+  name: &app system-upgrade-controller
   namespace: flux-system
 spec:
+  targetNamespace: system-upgrade
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
   prune: true
   sourceRef:
@@ -18,11 +22,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-system-upgrade-controller-plans
+  name: &app system-upgrade-controller-plans
   namespace: flux-system
 spec:
+  targetNamespace: system-upgrade
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-system-upgrade-controller
+    - name: system-upgrade-controller
   path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2
index 192774c5..35f94c74 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: upgrade.cattle.io/v1
 kind: Plan
 metadata:
   name: agent
-  namespace: system-upgrade
 spec:
   # renovate: datasource=github-releases depName=k3s-io/k3s
   version: "v1.28.3+k3s1"
diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2
index c2487887..ab3643f6 100644
--- a/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2
+++ b/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: upgrade.cattle.io/v1
 kind: Plan
 metadata:
   name: server
-  namespace: system-upgrade
 spec:
   # renovate: datasource=github-releases depName=k3s-io/k3s
   version: "v1.28.3+k3s1"
diff --git a/bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2
index 48161e1f..5013ade7 100644
--- a/bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: weave-gitops
-  namespace: flux-system
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2 b/bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2
index 3805ad86..95bf4747 100644
--- a/bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2
+++ b/bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: flux-system
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2 b/bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2
index ae023784..22486957 100644
--- a/bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2
+++ b/bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: cluster-user-auth
-  namespace: flux-system
 type: Opaque
 stringData:
   username: admin
diff --git a/bootstrap/templates/addons/weave-gitops/ks.yaml.j2 b/bootstrap/templates/addons/weave-gitops/ks.yaml.j2
index efb4a0c6..9a2bd272 100644
--- a/bootstrap/templates/addons/weave-gitops/ks.yaml.j2
+++ b/bootstrap/templates/addons/weave-gitops/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-weave-gitops
+  name: &app weave-gitops
   namespace: flux-system
 spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/flux-system/weave-gitops/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2
index cccb4eb5..655ebfb8 100644
--- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cert-manager
-  namespace: cert-manager
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2
index d7e7064c..8ae52667 100644
--- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
   - ./helmrelease.yaml
   - ./prometheusrule.yaml
diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2
index 34eb6887..a7541f6d 100644
--- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2
@@ -4,7 +4,6 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   name: cert-manager.rules
-  namespace: cert-manager
 spec:
   groups:
     - name: cert-manager
diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2
index 18b1db7b..d1f6e1bf 100644
--- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2
@@ -3,6 +3,5 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: cert-manager-secret
-  namespace: cert-manager
 stringData:
   api-token: "{{ bootstrap_cloudflare_token }}"
diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
index c5fb6a6c..ea0d2af9 100644
--- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cert-manager
+  name: &app cert-manager
   namespace: flux-system
 spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/cert-manager/cert-manager/app
   prune: true
   sourceRef:
@@ -18,11 +22,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cert-manager-issuers
+  name: &app cert-manager-issuers
   namespace: flux-system
 spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-cert-manager
+    - name: cert-manager
   path: ./kubernetes/apps/cert-manager/cert-manager/issuers
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2
index 3eef3c51..84f17e56 100644
--- a/bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-flux-webhooks
+  name: &app flux-webhooks
   namespace: flux-system
 spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/flux-system/addons/webhooks
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2
index c6d00709..747a872d 100644
--- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: flux-webhook
-  namespace: flux-system
   annotations:
     external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
     hajimari.io/enable: "false"
diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2
index b4f78ca6..cca5931b 100644
--- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: notification.toolkit.fluxcd.io/v1
 kind: Receiver
 metadata:
   name: github-receiver
-  namespace: flux-system
 spec:
   type: github
   events:
diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2
index 4a63b880..b4bb682c 100644
--- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2
@@ -3,6 +3,5 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: github-webhook-token-secret
-  namespace: flux-system
 stringData:
   token: "{{ bootstrap_flux_github_webhook_token }}"
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
index cc3fcb89..e3afa706 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cilium
-  namespace: kube-system
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
index 6da68b2b..ba9fd9c3 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
@@ -4,7 +4,6 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: cilium-values
-  namespace: kube-system
 data:
   values.yaml: |
     autoDirectNodeRoutes: true
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
index 5d10cf6f..fedf3812 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
@@ -2,7 +2,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
   {% if not bootstrap_ipv6_enabled | default(false) %}
   - ./cilium-l2.yaml
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/ks.yaml.j2
index 7d29d982..34fbd9a9 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cilium
+  name: &app cilium
   namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/cilium/app
   prune: false # never should be deleted
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
index e2972993..c0e2020d 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: coredns
-  namespace: kube-system
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
index 1c3fdb04..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2
index c036bad9..bf2a537e 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-coredns
+  name: &app coredns
   namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/coredns/app
   prune: false # never should be deleted
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
index 6b9dc1e7..61447694 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
@@ -9,6 +9,7 @@ resources:
   - ./local-path-provisioner/ks.yaml
   - ./metrics-server/ks.yaml
   - ./reloader/ks.yaml
+  - ./snapshot-controller/ks.yaml
   {% if csi_driver_nfs.enabled | default(false) %}
   - ./csi-driver-nfs/ks.yaml
   {% endif %}
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/helmrelease.yaml.j2
index be4f0f6f..a9205a15 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: local-path-provisioner
-  namespace: kube-system
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/kustomization.yaml.j2
index 1c3fdb04..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/ks.yaml.j2
index 985be51e..63953389 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/local-path-provisioner/ks.yaml.j2
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-local-path-provisioner
+  name: &app local-path-provisioner
   namespace: flux-system
   labels:
     substitution.flux.home.arpa/disabled: "true"
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/local-path-provisioner/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2
index 02bbff62..b61f0405 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: metrics-server
-  namespace: kube-system
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2
index 1c3fdb04..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2
index d10ca1fb..244f53c1 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-metrics-server
+  name: &app metrics-server
   namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/metrics-server/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2
index 1c3fdb04..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/reloader/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/reloader/ks.yaml.j2
index 27a247c5..9aa42993 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/reloader/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/reloader/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-reloader
+  name: &app reloader
   namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/reloader/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/helmrelease.yaml.j2
new file mode 100644
index 00000000..76260d2a
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/helmrelease.yaml.j2
@@ -0,0 +1,33 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: snapshot-controller
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: snapshot-controller
+      version: 2.0.2
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controller:
+      serviceMonitor:
+        create: true
+    webhook:
+      enabled: false
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2
new file mode 100644
index 00000000..17cbc72b
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/app/kustomization.yaml.j2
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/ks.yaml.j2
new file mode 100644
index 00000000..fff4f41a
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/kube-system/snapshot-controller/ks.yaml.j2
@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app snapshot-controller
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/kube-system/snapshot-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
diff --git a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/dnsendpoint.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/dnsendpoint.yaml.j2
index 2a748f94..43d7d7b2 100644
--- a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/dnsendpoint.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/dnsendpoint.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: externaldns.k8s.io/v1alpha1
 kind: DNSEndpoint
 metadata:
   name: cloudflared
-  namespace: networking
 spec:
   endpoints:
     - dnsName: "external.${SECRET_DOMAIN}"
diff --git a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml.j2
index 88a8677f..cac9615c 100644
--- a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cloudflared
-  namespace: networking
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/kustomization.yaml.j2
index 0536740d..891a864a 100644
--- a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
   - ./dnsendpoint.yaml
   - ./secret.sops.yaml
diff --git a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/secret.sops.yaml.j2
index ad63f1ef..3e7dc1ac 100644
--- a/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/secret.sops.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/cloudflared/app/secret.sops.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: cloudflared-secret
-  namespace: networking
 stringData:
   TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
   credentials.json: |
diff --git a/bootstrap/templates/kubernetes/apps/networking/cloudflared/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/cloudflared/ks.yaml.j2
index 11e3a471..629e1108 100644
--- a/bootstrap/templates/kubernetes/apps/networking/cloudflared/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/cloudflared/ks.yaml.j2
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cloudflared
+  name: &app cloudflared
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-external-dns
+    - name: external-dns
   path: ./kubernetes/apps/networking/cloudflared/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/networking/echo-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/echo-server/app/helmrelease.yaml.j2
index 6bfbb805..b76b99e7 100644
--- a/bootstrap/templates/kubernetes/apps/networking/echo-server/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/echo-server/app/helmrelease.yaml.j2
@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: echo-server
-  namespace: networking
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/networking/echo-server/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/echo-server/app/kustomization.yaml.j2
index c83d92a8..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/networking/echo-server/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/echo-server/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/networking/echo-server/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/echo-server/ks.yaml.j2
index 0fe3d81a..a2c643c6 100644
--- a/bootstrap/templates/kubernetes/apps/networking/echo-server/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/echo-server/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-echo-server
+  name: &app echo-server
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/networking/echo-server/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/networking/external-dns/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/external-dns/app/helmrelease.yaml.j2
index f5662b12..9c1d93ce 100644
--- a/bootstrap/templates/kubernetes/apps/networking/external-dns/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/external-dns/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: &app external-dns
-  namespace: networking
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/networking/external-dns/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/external-dns/app/kustomization.yaml.j2
index 1278dd8b..069449ad 100644
--- a/bootstrap/templates/kubernetes/apps/networking/external-dns/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/external-dns/app/kustomization.yaml.j2
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
   - ./dnsendpoint-crd.yaml
   - ./secret.sops.yaml
diff --git a/bootstrap/templates/kubernetes/apps/networking/external-dns/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/external-dns/app/secret.sops.yaml.j2
index 7d62527d..075967d4 100644
--- a/bootstrap/templates/kubernetes/apps/networking/external-dns/app/secret.sops.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/external-dns/app/secret.sops.yaml.j2
@@ -3,6 +3,5 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: external-dns-secret
-  namespace: networking
 stringData:
   api-token: "{{ bootstrap_cloudflare_token }}"
diff --git a/bootstrap/templates/kubernetes/apps/networking/external-dns/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/external-dns/ks.yaml.j2
index 9dcaf8c0..20a25912 100644
--- a/bootstrap/templates/kubernetes/apps/networking/external-dns/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/external-dns/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-external-dns
+  name: &app external-dns
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/networking/external-dns/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml.j2
index acef94d2..9a9fa603 100644
--- a/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: k8s-gateway
-  namespace: networking
 spec:
   interval: 30m
   chart:
diff --git a/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml.j2
index c83d92a8..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/ks.yaml.j2
index 502e1f2f..8fee22f0 100644
--- a/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/k8s-gateway/ks.yaml.j2
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-k8s-gateway
+  name: &app k8s-gateway
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   path: ./kubernetes/apps/networking/k8s-gateway/app
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/production.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/production.yaml.j2
index 952f2649..b5afdf41 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/production.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/production.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "${SECRET_DOMAIN/./-}-production"
-  namespace: networking
 spec:
   secretName: "${SECRET_DOMAIN/./-}-production-tls"
   issuerRef:
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/staging.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/staging.yaml.j2
index 7b3914fa..9c869425 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/staging.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/certificates/staging.yaml.j2
@@ -3,7 +3,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "${SECRET_DOMAIN/./-}-staging"
-  namespace: networking
 spec:
   secretName: "${SECRET_DOMAIN/./-}-staging-tls"
   issuerRef:
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/external/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/external/helmrelease.yaml.j2
index 3f32b558..faab5c82 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/external/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/external/helmrelease.yaml.j2
@@ -4,7 +4,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: nginx-external
-  namespace: networking
+  namespace: &namespace networking
 spec:
   interval: 30m
   chart:
@@ -70,7 +70,7 @@ spec:
         enabled: true
         serviceMonitor:
           enabled: true
-          namespace: networking
+          namespace: *namespace
           namespaceSelector:
             any: true
       extraArgs:
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/external/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/external/kustomization.yaml.j2
index c83d92a8..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/external/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/external/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/internal/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/internal/helmrelease.yaml.j2
index ad0d4ca5..dba0963c 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/internal/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/internal/helmrelease.yaml.j2
@@ -4,7 +4,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: nginx-internal
-  namespace: networking
+  namespace: &namespace networking
 spec:
   interval: 30m
   chart:
@@ -67,7 +67,7 @@ spec:
         enabled: true
         serviceMonitor:
           enabled: true
-          namespace: networking
+          namespace: *namespace
           namespaceSelector:
             any: true
       extraArgs:
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/internal/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/internal/kustomization.yaml.j2
index c83d92a8..5dd7baca 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/internal/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/internal/kustomization.yaml.j2
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
   - ./helmrelease.yaml
diff --git a/bootstrap/templates/kubernetes/apps/networking/nginx/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/nginx/ks.yaml.j2
index 60439e48..9cb24b81 100644
--- a/bootstrap/templates/kubernetes/apps/networking/nginx/ks.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/networking/nginx/ks.yaml.j2
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-nginx-certificates
+  name: &app nginx-certificates
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-cert-manager-issuers
+    - name: cert-manager-issuers
   path: ./kubernetes/apps/networking/nginx/certificates
   prune: true
   sourceRef:
@@ -20,11 +24,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-nginx-external
+  name: &app nginx-external
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-nginx-certificates
+    - name: nginx-certificates
   path: ./kubernetes/apps/networking/nginx/external
   prune: true
   sourceRef:
@@ -38,11 +46,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-nginx-internal
+  name: &app nginx-internal
   namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
   dependsOn:
-    - name: cluster-apps-nginx-certificates
+    - name: nginx-certificates
   path: ./kubernetes/apps/networking/nginx/internal
   prune: true
   sourceRef:
diff --git a/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2
new file mode 100644
index 00000000..2270ac3e
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/volsync/kustomization.yaml.j2
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Pre Flux-Kustomizations
+  - ./namespace.yaml
+  # Flux-Kustomizations
+  - ./volsync/ks.yaml
diff --git a/bootstrap/templates/kubernetes/apps/volsync/namespace.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/namespace.yaml.j2
new file mode 100644
index 00000000..b2062055
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/volsync/namespace.yaml.j2
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: volsync
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
diff --git a/bootstrap/templates/kubernetes/apps/volsync/volsync/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/helmrelease.yaml.j2
new file mode 100644
index 00000000..f32ef7a8
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/helmrelease.yaml.j2
@@ -0,0 +1,42 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: volsync
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: volsync
+      version: 0.8.0
+      sourceRef:
+        kind: HelmRepository
+        name: backube
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: snapshot-controller
+      namespace: kube-system
+  values:
+    manageCRDs: true
+    image:
+      # https://github.com/backube/volsync/issues/828
+      repository: &image ghcr.io/onedr0p/volsync
+      tag: &tag 0.8.0
+    rclone:
+      repository: *image
+      tag: *tag
+    restic:
+      repository: *image
+      tag: *tag
+    metrics:
+      disableAuth: true
diff --git a/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2
new file mode 100644
index 00000000..5e098843
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/kustomization.yaml.j2
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./prometheusrule.yaml
diff --git a/bootstrap/templates/kubernetes/apps/volsync/volsync/app/prometheusrule.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/prometheusrule.yaml.j2
new file mode 100644
index 00000000..b899d636
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/volsync/volsync/app/prometheusrule.yaml.j2
@@ -0,0 +1,27 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: volsync
+spec:
+  groups:
+    - name: volsync.rules
+      rules:
+        - alert: VolSyncComponentAbsent
+          annotations:
+            summary: VolSync component has disappeared from Prometheus target discovery.
+          expr: |
+            absent(up{job="volsync-metrics"})
+          for: 15m
+          labels:
+            severity: critical
+        - alert: VolSyncVolumeOutOfSync
+          annotations:
+            summary: >-
+              {{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume
+              is out of sync.
+          expr: |
+            volsync_volume_out_of_sync == 1
+          for: 15m
+          labels:
+            severity: critical
diff --git a/bootstrap/templates/kubernetes/apps/volsync/volsync/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/volsync/volsync/ks.yaml.j2
new file mode 100644
index 00000000..9913e31e
--- /dev/null
+++ b/bootstrap/templates/kubernetes/apps/volsync/volsync/ks.yaml.j2
@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app volsync
+  namespace: flux-system
+spec:
+  targetNamespace: volsync
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/volsync/volsync/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2
new file mode 100644
index 00000000..348802dc
--- /dev/null
+++ b/bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: backube
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://backube.github.io/helm-charts/
diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2
index 64a99c3f..df330874 100644
--- a/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2
+++ b/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2
@@ -2,6 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ./backube.yaml
   - ./bitnami.yaml
   - ./bjw-s.yaml
   - ./cilium.yaml
@@ -15,6 +16,7 @@ resources:
   - ./k8s-gateway.yaml
   - ./kubernetes-dashboard.yaml
   - ./metrics-server.yaml
+  - ./piraeus.yaml
   - ./prometheus-community.yaml
   - ./stakater.yaml
   - ./weave-gitops.yaml
diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2
new file mode 100644
index 00000000..cc285faa
--- /dev/null
+++ b/bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: piraeus
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://piraeus.io/helm-charts/