From 21a5b23a5825f3b5b35837ea05dbe9dc3fb40efc Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 08:54:16 +0200
Subject: [PATCH 01/68] feat: add simple-git dependency and new script for
 apl-operator

---
 package-lock.json            |  31 +++++
 package.json                 |   2 +
 src/operator/apl-operator.ts | 263 +++++++++++++++++++++++++++++++++++
 src/operator/main.ts         |  73 ++++++++++
 4 files changed, 369 insertions(+)
 create mode 100644 src/operator/apl-operator.ts
 create mode 100644 src/operator/main.ts

diff --git a/package-lock.json b/package-lock.json
index 94dcd84844..6d60770d68 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,6 +31,7 @@
         "minimatch": "^10.0.1",
         "node-forge": "1.3.1",
         "semver": "7.7.1",
+        "simple-git": "^3.23.0",
         "tar": "7.4.3",
         "uuid": "^11.1.0",
         "validator": "13.15.0",
@@ -4801,6 +4802,21 @@
         "openid-client": "^6.1.3"
       }
     },
+    "node_modules/@kwsites/file-exists": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@kwsites/file-exists/-/file-exists-1.1.1.tgz",
+      "integrity": "sha512-m9/5YGR18lIwxSFDwfE3oA7bWuq9kdau6ugN4H2rJeyhFQZcG9AgSHkQtSD15a8WvTgfz9aikZMrKPHvbpqFiw==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1"
+      }
+    },
+    "node_modules/@kwsites/promise-deferred": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@kwsites/promise-deferred/-/promise-deferred-1.1.1.tgz",
+      "integrity": "sha512-GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==",
+      "license": "MIT"
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "0.2.9",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.9.tgz",
@@ -24639,6 +24655,21 @@
         "node": ">=4"
       }
     },
+    "node_modules/simple-git": {
+      "version": "3.27.0",
+      "resolved": "https://registry.npmjs.org/simple-git/-/simple-git-3.27.0.tgz",
+      "integrity": "sha512-ivHoFS9Yi9GY49ogc6/YAi3Fl9ROnF4VyubNylgCkA+RVqLaKWnDSzXOVzya8csELIaWaYNutsEuAhZrtOjozA==",
+      "license": "MIT",
+      "dependencies": {
+        "@kwsites/file-exists": "^1.1.1",
+        "@kwsites/promise-deferred": "^1.1.1",
+        "debug": "^4.3.5"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/steveukx/git-js?sponsor=1"
+      }
+    },
     "node_modules/sisteransi": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
diff --git a/package.json b/package.json
index 547e010b7b..ba21d70d77 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "minimatch": "^10.0.1",
     "node-forge": "1.3.1",
     "semver": "7.7.1",
+    "simple-git": "^3.23.0",
     "tar": "7.4.3",
     "uuid": "^11.1.0",
     "validator": "13.15.0",
@@ -120,6 +121,7 @@
     "values-schema.yaml": "npm run gen:chart-schema"
   },
   "scripts": {
+    "apl-operator": "tsx src/operator/main.ts",
     "install-deps": "bin/install-deps.sh",
     "app-versions:csv": "echo 'name,appVersion,chartVersion'; for f in $(find charts -name Chart.yaml -type f -maxdepth 2| sort); do yq eval -o=json $f | jq -rc '. | [.name, .appVersion, .version] | @csv' | tr -d '\"'; done",
     "charts-update": "cd chart/chart-index && helm dep update",
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
new file mode 100644
index 0000000000..9493ffc87c
--- /dev/null
+++ b/src/operator/apl-operator.ts
@@ -0,0 +1,263 @@
+import simpleGit, { SimpleGit } from 'simple-git'
+import { terminal } from '../common/debug'
+import * as fs from 'fs'
+import retry from 'async-retry'
+import { HelmArguments } from '../common/yargs'
+import { prepareEnvironment } from '../common/cli'
+import { decrypt } from '../common/crypt'
+
+import { module as applyModule } from '../cmd/apply'
+import { module as applyAsAppsModule } from '../cmd/apply-as-apps'
+import { module as bootstrapModule } from '../cmd/bootstrap'
+import { module as validateValuesModule } from '../cmd/validate-values'
+import { setValuesFile } from '../common/repo'
+
+export class AplOperator {
+  private d = terminal('operator:apl')
+  private isRunning = false
+  private pollInterval = 1000
+  private lastRevision = ''
+  private repoPath = '/tmp/apl-operator/values'
+  private repoUrl: string
+  private git: SimpleGit
+
+  constructor(username: string, password: string, giteaUrl: string, pollIntervalMs?: number) {
+    this.pollInterval = pollIntervalMs ? pollIntervalMs : this.pollInterval
+
+    const giteaOrg = 'otomi'
+    const giteaRepo = 'values'
+    //TODO change this when going in to cluster
+    this.repoUrl = `https://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
+
+    // Remove existing directory if it exists
+    if (fs.existsSync(this.repoPath)) {
+      this.d.info('Removing existing repository directory')
+      fs.rmSync(this.repoPath, { recursive: true, force: true })
+    }
+
+    // Ensure parent directory exists
+    if (!fs.existsSync(this.repoPath)) {
+      fs.mkdirSync(this.repoPath, { recursive: true })
+    }
+
+    this.git = simpleGit({
+      baseDir: this.repoPath,
+    })
+
+    this.d.info(`Initialized APL operator with repo URL: ${this.repoUrl.replace(password, '***')}`)
+  }
+
+  private async waitForGitea(): Promise<boolean> {
+    this.d.info('Waiting for Gitea to be available...')
+
+    const maxRetries = 30
+    const retryDelay = 30000 // 30 seconds
+
+    return retry(
+      async () => {
+        try {
+          await this.git.listRemote(['--heads', this.repoUrl])
+          this.d.info('Gitea is available and repository is accessible')
+          return true
+        } catch (error) {
+          this.d.warn(`Gitea not available yet: ${error.message}`)
+          throw new Error('Gitea not available')
+        }
+      },
+      {
+        retries: maxRetries,
+        minTimeout: retryDelay,
+        maxTimeout: retryDelay,
+        onRetry: (error, attempt) => {
+          this.d.info(`Retry attempt ${attempt}/${maxRetries} - ${error.message}`)
+        },
+      },
+    )
+  }
+
+  private async cloneRepository(): Promise<void> {
+    this.d.info(`Cloning repository to ${this.repoPath}`)
+
+    // Clone the repository
+    try {
+      await this.git.clone(this.repoUrl, this.repoPath)
+
+      // Get the current commit hash
+      const log = await this.git.log({ maxCount: 1 })
+      this.lastRevision = log.latest?.hash || ''
+
+      this.d.info(`Repository cloned successfully, current revision: ${this.lastRevision}`)
+    } catch (error) {
+      this.d.error('Failed to clone repository:', error)
+      throw error
+    }
+  }
+
+  private async pullRepository(): Promise<boolean> {
+    this.d.info('Pulling latest changes from repository')
+
+    try {
+      // Pull the latest changes
+      await this.git.pull()
+
+      // Get a new commit hash
+      const log = await this.git.log({ maxCount: 1 })
+      const newRevision = log.latest?.hash || null
+
+      // Check if there are changes
+      if (newRevision && newRevision !== this.lastRevision) {
+        this.d.info(`Repository updated: ${this.lastRevision} -> ${newRevision}`)
+        this.lastRevision = newRevision
+        return true
+      } else {
+        this.d.info('No changes detected in repository')
+        return false
+      }
+    } catch (error) {
+      this.d.error('Failed to pull repository:', error)
+      throw error
+    }
+  }
+
+  private async executeBootstrap(): Promise<void> {
+    this.d.info('Executing bootstrap process')
+
+    try {
+      process.env.ENV_DIR = this.repoPath
+      await bootstrapModule.handler({} as HelmArguments)
+      await setValuesFile(this.repoPath)
+      this.d.info('Bootstrap completed successfully')
+    } catch (error) {
+      this.d.error('Bootstrap failed:', error)
+      throw error
+    }
+  }
+
+  private async executeValidateValues(): Promise<void> {
+    this.d.info('Validating values')
+
+    try {
+      // Execute validate-values command
+      process.env.ENV_DIR = this.repoPath
+      await validateValuesModule.handler({} as HelmArguments)
+      this.d.info('Values validation completed successfully')
+    } catch (error) {
+      this.d.error('Values validation failed:', error)
+      throw error
+    }
+  }
+
+  private async executeApply(): Promise<void> {
+    this.d.info('Executing apply')
+
+    try {
+      // Prepare the environment and set ENV_DIR
+      process.env.ENV_DIR = this.repoPath
+
+      // We need to prepare and parse arguments as expected by the apply module
+      const args: HelmArguments = { args: '--tekton' } as HelmArguments
+
+      // Use the handler from the module
+      await applyModule.handler(args)
+
+      this.d.info('Apply completed successfully')
+    } catch (error) {
+      this.d.error('Apply failed:', error)
+      throw error
+    }
+  }
+
+  private async executeApplyAsApps(): Promise<void> {
+    this.d.info('Executing applyAsApps for teams')
+
+    try {
+      // Set the environment
+      process.env.ENV_DIR = this.repoPath
+
+      const args: HelmArguments = {
+        l: ['pipeline=otomi-task-teams'],
+      } as HelmArguments
+
+      // Use the handler from the module
+      await applyAsAppsModule.handler(args)
+
+      this.d.info('ApplyAsApps for teams completed successfully')
+    } catch (error) {
+      this.d.error('ApplyAsApps for teams failed:', error)
+      throw error
+    }
+  }
+
+  private async pollForChanges(): Promise<void> {
+    if (!this.isRunning) return
+
+    try {
+      const hasChanges = await this.pullRepository()
+
+      if (hasChanges) {
+        this.d.info('Changes detected, triggering apply process')
+
+        // Execute the following in parallel
+        await Promise.all([this.executeApply(), this.executeApplyAsApps()])
+
+        this.d.info('Apply process completed successfully')
+      }
+
+      // Schedule next poll
+      setTimeout(() => {
+        void this.pollForChanges()
+      }, this.pollInterval)
+    } catch (error) {
+      this.d.error('Error during polling:', error)
+
+      // If we encounter an error, retry after a delay
+      if (this.isRunning) {
+        this.d.info(`Retrying in ${this.pollInterval}ms`)
+        setTimeout(() => {
+          void this.pollForChanges()
+        }, this.pollInterval)
+      }
+    }
+  }
+
+  public async start(): Promise<void> {
+    if (this.isRunning) {
+      this.d.warn('Operator is already running')
+      return
+    }
+
+    this.isRunning = true
+    this.d.info('Starting APL operator')
+
+    try {
+      // Step 1: Wait for Gitea to be available
+      await this.waitForGitea()
+
+      await this.cloneRepository()
+
+      await this.executeBootstrap()
+
+      await this.executeValidateValues()
+
+      await Promise.all([this.executeApply(), this.executeApplyAsApps()])
+
+      await this.pollForChanges()
+
+      this.d.info('APL operator started successfully')
+    } catch (error) {
+      this.isRunning = false
+      this.d.error('Failed to start APL operator:', error)
+      throw error
+    }
+  }
+
+  public stop(): void {
+    if (!this.isRunning) {
+      this.d.warn('Operator is not running')
+      return
+    }
+
+    this.d.info('Stopping APL operator')
+    this.isRunning = false
+  }
+}
diff --git a/src/operator/main.ts b/src/operator/main.ts
new file mode 100644
index 0000000000..53e4521192
--- /dev/null
+++ b/src/operator/main.ts
@@ -0,0 +1,73 @@
+import * as dotenv from 'dotenv'
+import { terminal } from '../common/debug'
+import { AplOperator } from './apl-operator'
+
+// Load environment variables
+dotenv.config()
+
+const d = terminal('operator:main')
+
+interface OperatorConfig {
+  giteaUsername: string
+  giteaPassword: string
+  giteaUrl: string
+}
+
+// Load configuration from environment variables
+function loadConfig(): OperatorConfig {
+  const giteaUsername = process.env.GITEA_USERNAME
+  const giteaPassword = process.env.GITEA_PASSWORD
+  const giteaUrl = process.env.GITEA_URL
+
+  return {
+    giteaUsername,
+    giteaPassword,
+    giteaUrl,
+  }
+}
+
+// Gracefully handle termination signals
+function handleTerminationSignals(operator: AplOperator): void {
+  function exitHandler(signal: string) {
+    d.info(`Received ${signal}, shutting down...`)
+    operator.stop()
+    process.exit(0)
+  }
+
+  process.on('SIGTERM', () => exitHandler('SIGTERM'))
+  process.on('SIGINT', () => exitHandler('SIGINT'))
+}
+
+// Main function
+async function main(): Promise<void> {
+  try {
+    d.info('Starting APL Operator')
+
+    // Load configuration
+    const config = loadConfig()
+
+    // Create and start the Gitea operator
+    const operator = new AplOperator(config.giteaUsername, config.giteaPassword, config.giteaUrl)
+
+    // Set up signal handlers
+    handleTerminationSignals(operator)
+
+    // Start the operator
+    await operator.start()
+
+    d.info('APL Operator started successfully')
+  } catch (error) {
+    d.error('Failed to start APL Operator:', error)
+    process.exit(1)
+  }
+}
+
+// Run the main function if this file is executed directly
+if (require.main === module) {
+  main().catch((error) => {
+    d.error('Unhandled error in main:', error)
+    process.exit(1)
+  })
+}
+
+export default main

From 8cdded2117b4e98a88f25a0d7969b17806313095 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 08:59:29 +0200
Subject: [PATCH 02/68] fix: eslint errors

---
 src/operator/apl-operator.ts | 2 +-
 src/operator/main.ts         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 9493ffc87c..945ee50ad4 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -68,7 +68,7 @@ export class AplOperator {
         retries: maxRetries,
         minTimeout: retryDelay,
         maxTimeout: retryDelay,
-        onRetry: (error, attempt) => {
+        onRetry: (error: any, attempt) => {
           this.d.info(`Retry attempt ${attempt}/${maxRetries} - ${error.message}`)
         },
       },
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 53e4521192..8ca5a7b6a9 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -15,9 +15,9 @@ interface OperatorConfig {
 
 // Load configuration from environment variables
 function loadConfig(): OperatorConfig {
-  const giteaUsername = process.env.GITEA_USERNAME
-  const giteaPassword = process.env.GITEA_PASSWORD
-  const giteaUrl = process.env.GITEA_URL
+  const giteaUsername = process.env.GITEA_USERNAME!
+  const giteaPassword = process.env.GITEA_PASSWORD!
+  const giteaUrl = process.env.GITEA_URL!
 
   return {
     giteaUsername,

From cccc3c22fd35913a9c8f999a8965beeb8ad2ed6f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 15:39:34 +0200
Subject: [PATCH 03/68] feat: add apl-operator chart

---
 Dockerfile                                    |   2 +-
 charts/apl-operator/.helmignore               |  23 +++
 charts/apl-operator/Chart.yaml                |  24 +++
 charts/apl-operator/templates/NOTES.txt       |   1 +
 charts/apl-operator/templates/_helpers.tpl    |  62 +++++++
 charts/apl-operator/templates/deployment.yaml |  55 ++++++
 charts/apl-operator/templates/rbac.yaml       | 165 ++++++++++++++++++
 charts/apl-operator/templates/secret.yaml     |  47 +++++
 charts/apl-operator/values.yaml               |  63 +++++++
 helmfile.d/helmfile-03.init.yaml              |   7 +
 helmfile.d/helmfile-09.init.yaml              |  12 +-
 helmfile.d/snippets/defaults.yaml             |  10 ++
 package.json                                  |   2 +-
 src/cmd/apply.ts                              |   6 +-
 src/cmd/commit.ts                             |   2 +-
 src/common/envalid.ts                         |   2 +
 src/common/values.ts                          |   5 +-
 src/operator/apl-operator.ts                  | 144 ++++++++-------
 src/operator/main.ts                          |   8 +-
 src/operator/validators.ts                    |  10 ++
 values/apl-operator/apl-operator.gotmpl       |  22 +++
 21 files changed, 579 insertions(+), 93 deletions(-)
 create mode 100644 charts/apl-operator/.helmignore
 create mode 100644 charts/apl-operator/Chart.yaml
 create mode 100644 charts/apl-operator/templates/NOTES.txt
 create mode 100644 charts/apl-operator/templates/_helpers.tpl
 create mode 100644 charts/apl-operator/templates/deployment.yaml
 create mode 100644 charts/apl-operator/templates/rbac.yaml
 create mode 100644 charts/apl-operator/templates/secret.yaml
 create mode 100644 charts/apl-operator/values.yaml
 create mode 100644 src/operator/validators.ts
 create mode 100644 values/apl-operator/apl-operator.gotmpl

diff --git a/Dockerfile b/Dockerfile
index 09154dec14..8e96076c07 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,4 +42,4 @@ COPY --from=ci /home/app/stack/dist /home/app/stack/dist
 COPY --from=clean /home/app/stack/node_modules /home/app/stack/node_modules
 COPY --chown=app . .
 
-CMD ["dist/src/otomi.js"]
+CMD if [ "$RUN_AS_OPERATOR" = "true" ]; then node dist/src/operator/main.js; else dist/src/otomi.js; fi
diff --git a/charts/apl-operator/.helmignore b/charts/apl-operator/.helmignore
new file mode 100644
index 0000000000..0e8a0eb36f
--- /dev/null
+++ b/charts/apl-operator/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/apl-operator/Chart.yaml b/charts/apl-operator/Chart.yaml
new file mode 100644
index 0000000000..6c548ff390
--- /dev/null
+++ b/charts/apl-operator/Chart.yaml
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: apl-operator
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
diff --git a/charts/apl-operator/templates/NOTES.txt b/charts/apl-operator/templates/NOTES.txt
new file mode 100644
index 0000000000..af7c19e2cc
--- /dev/null
+++ b/charts/apl-operator/templates/NOTES.txt
@@ -0,0 +1 @@
+The apl-operator has been deployed.
diff --git a/charts/apl-operator/templates/_helpers.tpl b/charts/apl-operator/templates/_helpers.tpl
new file mode 100644
index 0000000000..c6239f150a
--- /dev/null
+++ b/charts/apl-operator/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "apl-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "apl-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "apl-operator.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "apl-operator.labels" -}}
+helm.sh/chart: {{ include "apl-operator.chart" . }}
+{{ include "apl-operator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "apl-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "apl-operator.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "apl-operator.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "apl-operator.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
new file mode 100644
index 0000000000..d1c80bd829
--- /dev/null
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "apl-operator.fullname" . }}
+  labels:
+    {{- include "apl-operator.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "apl-operator.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "apl-operator.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "apl-operator.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: [npm, run, operator:gitea]
+          env:
+            - name: RUN_AS_OPERATOR
+              value: "true"
+            - name: ENV_DIR
+              value: "{{ .Values.env.ENV_DIR }}"
+            - name: GITEA_OPERATOR_NAMESPACE
+              value: "{{ .Values.env.GITEA_OPERATOR_NAMESPACE }}"
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
new file mode 100644
index 0000000000..d5e2568f4f
--- /dev/null
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -0,0 +1,165 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: apl-operator
+  namespace: {{ .Release.Namespace }}
+---
+# Role for operations in the otomi namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: apl-operator
+  namespace: {{ .Release.Namespace }}
+rules:
+  # Needed for deployment state management
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "create", "update", "patch"]
+    resourceNames: ["otomi-deployment-status"]
+
+  # General ConfigMap operations for other ConfigMaps
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "create"]
+
+  # Secret management for stored credentials
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+    resourceNames: ["otomi-deployment-passwords"]
+
+  # General Secret operations for other secrets
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "create"]
+---
+# Role for operations in the argocd namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: apl-operator
+  namespace: argocd
+rules:
+  # ArgoCD application management
+  - apiGroups: ["argoproj.io"]
+    resources: ["applications"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+
+  # For patching ArgoCD application controller
+  - apiGroups: ["apps"]
+    resources: ["statefulsets"]
+    verbs: ["get", "list", "patch"]
+    resourceNames: ["argocd-application-controller"]
+
+  # For restarting ArgoCD pods
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "delete"]
+---
+# Role for accessing ingress resources
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: apl-operator
+  namespace: ingress
+rules:
+  # Needed for LoadBalancer IP/hostname retrieval
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get"]
+    resourceNames: ["ingress-nginx-platform-controller"]
+---
+# RoleBinding for otomi namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: apl-operator
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: apl-operator
+  apiGroup: rbac.authorization.k8s.io
+---
+# RoleBinding for argocd namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: apl-operator
+  namespace: argocd
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: apl-operator
+  apiGroup: rbac.authorization.k8s.io
+---
+# RoleBinding for ingress namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: apl-operator
+  namespace: ingress
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: apl-operator
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: apl-operator-crds
+rules:
+  # Required for applying the Prometheus CRDs
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "create", "update", "patch"]
+    resourceNames:
+      - "alertmanagerconfigs.monitoring.coreos.com"
+      - "alertmanagers.monitoring.coreos.com"
+      - "podmonitors.monitoring.coreos.com"
+      - "probes.monitoring.coreos.com"
+      - "prometheuses.monitoring.coreos.com"
+      - "prometheusrules.monitoring.coreos.com"
+      - "servicemonitors.monitoring.coreos.com"
+      - "thanosrulers.monitoring.coreos.com"
+
+  # Required for applying Tekton Triggers CRDs
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "create", "update", "patch"]
+    resourceNames:
+      - "clusterinterceptors.triggers.tekton.dev"
+      - "clustertriggerbindings.triggers.tekton.dev"
+      - "eventlisteners.triggers.tekton.dev"
+      - "interceptors.triggers.tekton.dev"
+      - "triggers.triggers.tekton.dev"
+      - "triggerbindings.triggers.tekton.dev"
+      - "triggertemplates.triggers.tekton.dev"
+
+  # For listing CRDs (needed to check existence)
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: apl-operator-crds
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: otomi
+roleRef:
+  kind: ClusterRole
+  name: apl-operator-crds
+  apiGroup: rbac.authorization.k8s.io
diff --git a/charts/apl-operator/templates/secret.yaml b/charts/apl-operator/templates/secret.yaml
new file mode 100644
index 0000000000..a2d7f75c37
--- /dev/null
+++ b/charts/apl-operator/templates/secret.yaml
@@ -0,0 +1,47 @@
+{{- $kms := .Values.kms | default dict }}
+{{- if hasKey $kms "sops" }}
+{{- $v := $kms.sops }}
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: apl-sops-secrets
+  namespace: {{ .Release.Namespace }}
+type: Opaque
+data:
+{{- with $v.azure }}
+  AZURE_CLIENT_ID: {{ .clientId | b64enc }}
+  AZURE_CLIENT_SECRET: {{ .clientSecret | b64enc }}
+{{- with .tenantId }}
+  AZURE_TENANT_ID: {{ . | b64enc }}{{ end }}
+{{- with .environment }}
+  AZURE_ENVIRONMENT: {{ . | b64enc }}{{ end }}
+{{- end }}
+{{- with $v.aws }}
+  AWS_ACCESS_KEY_ID: {{ .accessKey | b64enc }}
+  AWS_SECRET_ACCESS_KEY: {{ .secretKey | b64enc }}
+{{- with .region }}
+  AWS_REGION: {{ . | b64enc }}{{ end }}
+{{- end }}
+{{- with $v.age }}
+  SOPS_AGE_KEY: {{ .privateKey | b64enc }}
+{{- end }}
+{{- with $v.google }}
+  GCLOUD_SERVICE_KEY: {{ .accountJson | b64enc }}
+{{- with .project }}
+  GOOGLE_PROJECT: {{ . | b64enc }}{{ end }}
+{{- with .region }}
+  GOOGLE_REGION: {{ . | b64enc }}{{ end }}
+{{- end }}
+{{- end }}
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-credentials
+  namespace: {{ .Release.Namespace }}
+type: kubernetes.io/basic-auth
+stringData:
+  username: otomi-admin
+  password: {{ .Values.giteaPassword }}
diff --git a/charts/apl-operator/values.yaml b/charts/apl-operator/values.yaml
new file mode 100644
index 0000000000..66d7eb18f5
--- /dev/null
+++ b/charts/apl-operator/values.yaml
@@ -0,0 +1,63 @@
+# Default values for apl-operator.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  repository: linode/apl-core
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: main
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# Service Account requires access to gitea pod to edit the oauth through CLI commands
+serviceAccount:
+  create: true
+  name: "apl-operator"
+  annotations: {}
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1001
+  runAsGroup: 1001
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1001
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+env: {}
+
+kms: {}
+
+giteaPassword: ""
diff --git a/helmfile.d/helmfile-03.init.yaml b/helmfile.d/helmfile-03.init.yaml
index 86acdfd2b3..7481eb9bef 100644
--- a/helmfile.d/helmfile-03.init.yaml
+++ b/helmfile.d/helmfile-03.init.yaml
@@ -75,6 +75,13 @@ releases:
     labels:
       pkg: apl-harbor-operator
     <<: *default
+  - name: apl-operator
+    installed: true
+    namespace: apl-operator
+    labels:
+      pkg: apl-operator
+      app: core
+    <<: *default
   - name: kiali-operator-artifacts
     installed: {{ $a | get "kiali.enabled" }}
     namespace: kiali
diff --git a/helmfile.d/helmfile-09.init.yaml b/helmfile.d/helmfile-09.init.yaml
index a998ba629a..481d70a04c 100644
--- a/helmfile.d/helmfile-09.init.yaml
+++ b/helmfile.d/helmfile-09.init.yaml
@@ -45,9 +45,9 @@ releases:
       pkg: tekton-triggers
       app: core
     <<: *default
-  - name: otomi-pipelines
-    installed: true
-    namespace: otomi-pipelines
-    labels:
-      app: core
-    <<: *default
+#  - name: otomi-pipelines
+#    installed: true
+#    namespace: otomi-pipelines
+#    labels:
+#      app: core
+#    <<: *default
diff --git a/helmfile.d/snippets/defaults.yaml b/helmfile.d/snippets/defaults.yaml
index 9743a65210..19d052107e 100644
--- a/helmfile.d/snippets/defaults.yaml
+++ b/helmfile.d/snippets/defaults.yaml
@@ -945,6 +945,16 @@ environments:
                   cpu: "1"
                   memory: 1Gi
             _rawValues: {}
+          apl-operator:
+            resources:
+              operator:
+                requests:
+                  cpu: 50m
+                  memory: 128Mi
+                limits:
+                  cpu: "1"
+                  memory: 1Gi
+            _rawValues: {}
           apl-keycloak-operator:
             resources:
               operator:
diff --git a/package.json b/package.json
index ba21d70d77..c4f83bd34a 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,7 @@
     "values-schema.yaml": "npm run gen:chart-schema"
   },
   "scripts": {
-    "apl-operator": "tsx src/operator/main.ts",
+    "apl-operator": "tsx watch src/operator/main.ts",
     "install-deps": "bin/install-deps.sh",
     "app-versions:csv": "echo 'name,appVersion,chartVersion'; for f in $(find charts -name Chart.yaml -type f -maxdepth 2| sort); do yq eval -o=json $f | jq -rc '. | [.name, .appVersion, .version] | @csv' | tr -d '\"'; done",
     "charts-update": "cd chart/chart-index && helm dep update",
diff --git a/src/cmd/apply.ts b/src/cmd/apply.ts
index 52d7323a8c..e4b7e52167 100644
--- a/src/cmd/apply.ts
+++ b/src/cmd/apply.ts
@@ -77,7 +77,7 @@ const applyAll = async () => {
   d.info('Deploying charts containing label stage=prep')
   await hf(
     {
-      // 'fileOpts' limits the hf scope and avoids parse errors (we only have basic values in this statege):
+      // 'fileOpts' limits the hf scope and avoids parse errors (we only have basic values at this stage):
       fileOpts: 'helmfile.d/helmfile-02.init.yaml',
       labelOpts: ['stage=prep'],
       logLevel: logLevelString(),
@@ -86,14 +86,12 @@ const applyAll = async () => {
     { streams: { stdout: d.stream.log, stderr: d.stream.error } },
   )
 
-  let labelOpts = ['']
   if (initialInstall) {
     // When Otomi is installed for the very first time and ArgoCD is not yet there.
     // Only install the core apps
-    labelOpts = ['app=core']
     await hf(
       {
-        labelOpts,
+        labelOpts: ['app=core'],
         logLevel: logLevelString(),
         args: hfArgs,
       },
diff --git a/src/cmd/commit.ts b/src/cmd/commit.ts
index e42b3974bf..2b40cd3e94 100644
--- a/src/cmd/commit.ts
+++ b/src/cmd/commit.ts
@@ -99,7 +99,7 @@ export const commit = async (initialInstall: boolean): Promise<void> => {
     await $`git remote set-url origin ${remote}`
   }
   // lets wait until the remote is ready
-  if (values?.apps!.gitea!.enabled ?? true) {
+  if (false) {
     await waitTillGitRepoAvailable(remote)
   }
   // continue
diff --git a/src/common/envalid.ts b/src/common/envalid.ts
index 3e0393a94b..ec1c584f93 100644
--- a/src/common/envalid.ts
+++ b/src/common/envalid.ts
@@ -32,6 +32,8 @@ export const cliEnvSpec = {
   RANDOM: bool({ desc: 'Randomizes the timeouts by multiplying with a factor between 1 to 2', default: false }),
   MIN_TIMEOUT: num({ desc: 'The number of milliseconds before starting the first retry', default: 60000 }),
   FACTOR: num({ desc: 'The factor to multiply the timeout with', default: 1 }),
+  GITEA_URL: str({ default: 'gitea-http.gitea.svc.cluster.local:3000' }),
+  GITEA_PROTOCOL: str({ default: 'http' }),
 }
 
 export function cleanEnv<T>(spec: { [K in keyof T]: ValidatorSpec<T[K]> }, options?: CleanOptions<T>) {
diff --git a/src/common/values.ts b/src/common/values.ts
index 1aef9c5c3e..df85bb5329 100644
--- a/src/common/values.ts
+++ b/src/common/values.ts
@@ -94,10 +94,11 @@ export const getRepo = (values: Record<string, any>): Repo => {
     username = 'otomi-admin'
     password = values?.apps?.gitea?.adminPassword
     email = `pipeline@cluster.local`
-    const giteaUrl = `gitea-http.gitea.svc.cluster.local:3000`
+    const giteaUrl = env.GITEA_URL
     const giteaOrg = 'otomi'
     const giteaRepo = 'values'
-    remote = `http://${username}:${encodeURIComponent(password)}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
+    const protocol = env.GITEA_PROTOCOL
+    remote = `${protocol}://${username}:${encodeURIComponent(password)}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
   }
   return { remote, branch, email, username, password }
 }
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 945ee50ad4..91188e3833 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -1,16 +1,14 @@
 import simpleGit, { SimpleGit } from 'simple-git'
 import { terminal } from '../common/debug'
 import * as fs from 'fs'
-import retry from 'async-retry'
 import { HelmArguments } from '../common/yargs'
-import { prepareEnvironment } from '../common/cli'
-import { decrypt } from '../common/crypt'
 
 import { module as applyModule } from '../cmd/apply'
 import { module as applyAsAppsModule } from '../cmd/apply-as-apps'
 import { module as bootstrapModule } from '../cmd/bootstrap'
 import { module as validateValuesModule } from '../cmd/validate-values'
 import { setValuesFile } from '../common/repo'
+import { waitTillGitRepoAvailable } from '../common/k8s'
 
 export class AplOperator {
   private d = terminal('operator:apl')
@@ -29,7 +27,7 @@ export class AplOperator {
     //TODO change this when going in to cluster
     this.repoUrl = `https://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
 
-    // Remove existing directory if it exists
+    // Remove the existing directory if it exists
     if (fs.existsSync(this.repoPath)) {
       this.d.info('Removing existing repository directory')
       fs.rmSync(this.repoPath, { recursive: true, force: true })
@@ -47,42 +45,16 @@ export class AplOperator {
     this.d.info(`Initialized APL operator with repo URL: ${this.repoUrl.replace(password, '***')}`)
   }
 
-  private async waitForGitea(): Promise<boolean> {
-    this.d.info('Waiting for Gitea to be available...')
-
-    const maxRetries = 30
-    const retryDelay = 30000 // 30 seconds
-
-    return retry(
-      async () => {
-        try {
-          await this.git.listRemote(['--heads', this.repoUrl])
-          this.d.info('Gitea is available and repository is accessible')
-          return true
-        } catch (error) {
-          this.d.warn(`Gitea not available yet: ${error.message}`)
-          throw new Error('Gitea not available')
-        }
-      },
-      {
-        retries: maxRetries,
-        minTimeout: retryDelay,
-        maxTimeout: retryDelay,
-        onRetry: (error: any, attempt) => {
-          this.d.info(`Retry attempt ${attempt}/${maxRetries} - ${error.message}`)
-        },
-      },
-    )
+  private async waitForGitea(): Promise<void> {
+    await waitTillGitRepoAvailable(this.repoUrl)
   }
 
   private async cloneRepository(): Promise<void> {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
-    // Clone the repository
     try {
       await this.git.clone(this.repoUrl, this.repoPath)
 
-      // Get the current commit hash
       const log = await this.git.log({ maxCount: 1 })
       this.lastRevision = log.latest?.hash || ''
 
@@ -93,22 +65,49 @@ export class AplOperator {
     }
   }
 
+  private async shouldSkipCommit(commitHash: string): Promise<boolean> {
+    try {
+      const logResult = await this.git.log({ maxCount: 1, from: commitHash, to: commitHash })
+
+      if (!logResult.latest) {
+        return false
+      }
+
+      const commitMessage = logResult.latest.message || ''
+      const skipMarker = '[ci skip]'
+
+      const shouldSkip = commitMessage.includes(skipMarker)
+
+      if (shouldSkip) {
+        this.d.info(`Commit ${commitHash.substring(0, 7)} contains "${skipMarker}" - skipping apply`)
+      }
+
+      return shouldSkip
+    } catch (error) {
+      this.d.error(`Error checking commit message for ${commitHash}:`, error)
+      return false
+    }
+  }
+
   private async pullRepository(): Promise<boolean> {
     this.d.info('Pulling latest changes from repository')
 
     try {
-      // Pull the latest changes
+      const previousRevision = this.lastRevision
+
       await this.git.pull()
 
-      // Get a new commit hash
       const log = await this.git.log({ maxCount: 1 })
-      const newRevision = log.latest?.hash || null
+      const newRevision = log.latest?.hash || ''
+
+      if (newRevision && newRevision !== previousRevision) {
+        this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
+
+        const shouldSkip = await this.shouldSkipCommit(newRevision)
 
-      // Check if there are changes
-      if (newRevision && newRevision !== this.lastRevision) {
-        this.d.info(`Repository updated: ${this.lastRevision} -> ${newRevision}`)
         this.lastRevision = newRevision
-        return true
+
+        return !shouldSkip
       } else {
         this.d.info('No changes detected in repository')
         return false
@@ -151,11 +150,11 @@ export class AplOperator {
     this.d.info('Executing apply')
 
     try {
-      // Prepare the environment and set ENV_DIR
-      process.env.ENV_DIR = this.repoPath
-
-      // We need to prepare and parse arguments as expected by the apply module
-      const args: HelmArguments = { args: '--tekton' } as HelmArguments
+      const args: HelmArguments = {
+        tekton: true,
+        _: [] as string[],
+        $0: '',
+      } as HelmArguments
 
       // Use the handler from the module
       await applyModule.handler(args)
@@ -171,14 +170,10 @@ export class AplOperator {
     this.d.info('Executing applyAsApps for teams')
 
     try {
-      // Set the environment
-      process.env.ENV_DIR = this.repoPath
-
       const args: HelmArguments = {
-        l: ['pipeline=otomi-task-teams'],
+        label: ['pipeline=otomi-task-teams'],
       } as HelmArguments
 
-      // Use the handler from the module
       await applyAsAppsModule.handler(args)
 
       this.d.info('ApplyAsApps for teams completed successfully')
@@ -188,36 +183,35 @@ export class AplOperator {
     }
   }
 
-  private async pollForChanges(): Promise<void> {
-    if (!this.isRunning) return
+  private async pollForChangesAndApplyIfAny(): Promise<void> {
+    this.d.info('Starting polling loop')
 
-    try {
-      const hasChanges = await this.pullRepository()
+    while (this.isRunning) {
+      try {
+        const hasChanges = await this.pullRepository()
 
-      if (hasChanges) {
-        this.d.info('Changes detected, triggering apply process')
+        if (hasChanges) {
+          this.d.info('Changes detected, triggering apply process')
 
-        // Execute the following in parallel
-        await Promise.all([this.executeApply(), this.executeApplyAsApps()])
+          // Execute them not in parallel as it resulted in issues
+          await this.executeApply()
+          await this.executeApplyAsApps()
 
-        this.d.info('Apply process completed successfully')
-      }
+          this.d.info('Apply process completed successfully')
+        } else {
+          this.d.info('No changes detected')
+        }
 
-      // Schedule next poll
-      setTimeout(() => {
-        void this.pollForChanges()
-      }, this.pollInterval)
-    } catch (error) {
-      this.d.error('Error during polling:', error)
-
-      // If we encounter an error, retry after a delay
-      if (this.isRunning) {
-        this.d.info(`Retrying in ${this.pollInterval}ms`)
-        setTimeout(() => {
-          void this.pollForChanges()
-        }, this.pollInterval)
+        await new Promise((resolve) => setTimeout(resolve, this.pollInterval))
+      } catch (error) {
+        this.d.error('Error during applying changes:', error)
+
+        // Optionally create prometheus metrics or alerts here
+        await new Promise((resolve) => setTimeout(resolve, this.pollInterval))
       }
     }
+
+    this.d.info('Polling loop stopped')
   }
 
   public async start(): Promise<void> {
@@ -230,7 +224,6 @@ export class AplOperator {
     this.d.info('Starting APL operator')
 
     try {
-      // Step 1: Wait for Gitea to be available
       await this.waitForGitea()
 
       await this.cloneRepository()
@@ -239,9 +232,10 @@ export class AplOperator {
 
       await this.executeValidateValues()
 
-      await Promise.all([this.executeApply(), this.executeApplyAsApps()])
+      await this.executeApply()
+      await this.executeApplyAsApps()
 
-      await this.pollForChanges()
+      await this.pollForChangesAndApplyIfAny()
 
       this.d.info('APL operator started successfully')
     } catch (error) {
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 8ca5a7b6a9..942693109a 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -1,6 +1,8 @@
 import * as dotenv from 'dotenv'
 import { terminal } from '../common/debug'
 import { AplOperator } from './apl-operator'
+import { operatorEnv } from './validators'
+import { env } from '../common/envalid'
 
 // Load environment variables
 dotenv.config()
@@ -15,9 +17,9 @@ interface OperatorConfig {
 
 // Load configuration from environment variables
 function loadConfig(): OperatorConfig {
-  const giteaUsername = process.env.GITEA_USERNAME!
-  const giteaPassword = process.env.GITEA_PASSWORD!
-  const giteaUrl = process.env.GITEA_URL!
+  const giteaUsername = operatorEnv.GITEA_USERNAME
+  const giteaPassword = operatorEnv.GITEA_PASSWORD
+  const giteaUrl = env.GITEA_URL
 
   return {
     giteaUsername,
diff --git a/src/operator/validators.ts b/src/operator/validators.ts
new file mode 100644
index 0000000000..c338b1cee7
--- /dev/null
+++ b/src/operator/validators.ts
@@ -0,0 +1,10 @@
+import dotenv from 'dotenv'
+import { cleanEnv, str } from 'envalid'
+
+// Load environment variables from .env file
+dotenv.config()
+export const operatorEnv = cleanEnv(process.env, {
+  GITEA_USERNAME: str({ desc: 'Gitea username' }),
+  GITEA_PASSWORD: str({ desc: 'Gitea password' }),
+  SOPS_AGE_KEY: str({ desc: 'SOPS age key' }),
+})
diff --git a/values/apl-operator/apl-operator.gotmpl b/values/apl-operator/apl-operator.gotmpl
new file mode 100644
index 0000000000..00badc1ebb
--- /dev/null
+++ b/values/apl-operator/apl-operator.gotmpl
@@ -0,0 +1,22 @@
+{{- $v := .Values }}
+{{- $o := $v.apps | get "apl-operator" }}
+{{- $version := $v.versions.tasks }}
+{{- $isSemver := regexMatch "^[0-9.]+" $version }}
+{{- $g := $v.apps.gitea }}
+{{- $kms := $v | get "kms" dict }}
+
+image:
+  tag: {{ printf "%s%s" ($isSemver | ternary "v" "") $version }}
+  pullPolicy: {{ $isSemver | ternary "IfNotPresent" "Always" }}
+
+{{- with $v.otomi | get "globalPullSecret" nil }}
+imagePullSecrets:
+  - name: otomi-pullsecret-global
+{{- end }}
+
+resources: {{- toYaml $o.resources.operator | nindent 2 }}
+
+kms: {{- $kms | toYaml | nindent 2 }}
+
+giteaPassword: {{ $g.adminPassword }}
+otomiVersion: {{ $v.otomi.version }}

From 5ee7b059123eb84ff38f88bae8b91b116788386f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 15:47:45 +0200
Subject: [PATCH 04/68] feat: update apl-chart

---
 charts/apl-operator/templates/deployment.yaml | 8 +++++---
 values/apl-operator/apl-operator.gotmpl       | 3 +++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index d1c80bd829..273cb42a13 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -31,14 +31,16 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command: [npm, run, operator:gitea]
           env:
             - name: RUN_AS_OPERATOR
               value: "true"
             - name: ENV_DIR
               value: "{{ .Values.env.ENV_DIR }}"
-            - name: GITEA_OPERATOR_NAMESPACE
-              value: "{{ .Values.env.GITEA_OPERATOR_NAMESPACE }}"
+          envFrom:
+            - secretRef:
+                name: gitea-credentials
+            - secretRef:
+                name: apl-sops-secrets
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/values/apl-operator/apl-operator.gotmpl b/values/apl-operator/apl-operator.gotmpl
index 00badc1ebb..311bcfc58d 100644
--- a/values/apl-operator/apl-operator.gotmpl
+++ b/values/apl-operator/apl-operator.gotmpl
@@ -20,3 +20,6 @@ kms: {{- $kms | toYaml | nindent 2 }}
 
 giteaPassword: {{ $g.adminPassword }}
 otomiVersion: {{ $v.otomi.version }}
+
+env:
+  ENV_DIR: /tmp/apl-operator/values

From 704470f859a3643db1dc30c78df947c26e1f3ffb Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 16:21:24 +0200
Subject: [PATCH 05/68] feat: update apl-chart

---
 Dockerfile                                    | 2 +-
 charts/apl-operator/templates/deployment.yaml | 4 ++++
 package.json                                  | 3 ++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 8e96076c07..09154dec14 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,4 +42,4 @@ COPY --from=ci /home/app/stack/dist /home/app/stack/dist
 COPY --from=clean /home/app/stack/node_modules /home/app/stack/node_modules
 COPY --chown=app . .
 
-CMD if [ "$RUN_AS_OPERATOR" = "true" ]; then node dist/src/operator/main.js; else dist/src/otomi.js; fi
+CMD ["dist/src/otomi.js"]
diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index 273cb42a13..b73160fc1c 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -31,6 +31,10 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - npm
+            - run
+            - apl-operator
           env:
             - name: RUN_AS_OPERATOR
               value: "true"
diff --git a/package.json b/package.json
index c4f83bd34a..ad9b1794a6 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,8 @@
     "values-schema.yaml": "npm run gen:chart-schema"
   },
   "scripts": {
-    "apl-operator": "tsx watch src/operator/main.ts",
+    "apl-operator": "tsx src/operator/main.ts",
+    "apl-operator:dev": "tsx watch src/operator/main.ts",
     "install-deps": "bin/install-deps.sh",
     "app-versions:csv": "echo 'name,appVersion,chartVersion'; for f in $(find charts -name Chart.yaml -type f -maxdepth 2| sort); do yq eval -o=json $f | jq -rc '. | [.name, .appVersion, .version] | @csv' | tr -d '\"'; done",
     "charts-update": "cd chart/chart-index && helm dep update",

From e4060f2a7f2359507eedc732f9d5e6bc164e361e Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 16:44:20 +0200
Subject: [PATCH 06/68] feat: update apl-chart

---
 values/apl-operator/apl-operator.gotmpl | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/values/apl-operator/apl-operator.gotmpl b/values/apl-operator/apl-operator.gotmpl
index 311bcfc58d..5e7dae3598 100644
--- a/values/apl-operator/apl-operator.gotmpl
+++ b/values/apl-operator/apl-operator.gotmpl
@@ -1,12 +1,12 @@
 {{- $v := .Values }}
 {{- $o := $v.apps | get "apl-operator" }}
-{{- $version := $v.versions.tasks }}
+{{- $version := $v.otomi.version }}
 {{- $isSemver := regexMatch "^[0-9.]+" $version }}
 {{- $g := $v.apps.gitea }}
 {{- $kms := $v | get "kms" dict }}
 
 image:
-  tag: {{ printf "%s%s" ($isSemver | ternary "v" "") $version }}
+  tag: {{ $version }}
   pullPolicy: {{ $isSemver | ternary "IfNotPresent" "Always" }}
 
 {{- with $v.otomi | get "globalPullSecret" nil }}
@@ -19,7 +19,6 @@ resources: {{- toYaml $o.resources.operator | nindent 2 }}
 kms: {{- $kms | toYaml | nindent 2 }}
 
 giteaPassword: {{ $g.adminPassword }}
-otomiVersion: {{ $v.otomi.version }}
 
 env:
   ENV_DIR: /tmp/apl-operator/values

From 14f4a2be2810538aea566b30684875a8edcbdb56 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 17:03:35 +0200
Subject: [PATCH 07/68] feat: update apl-chart

---
 charts/apl-operator/templates/secret.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/secret.yaml b/charts/apl-operator/templates/secret.yaml
index a2d7f75c37..f3dcf577cf 100644
--- a/charts/apl-operator/templates/secret.yaml
+++ b/charts/apl-operator/templates/secret.yaml
@@ -43,5 +43,5 @@ metadata:
   namespace: {{ .Release.Namespace }}
 type: kubernetes.io/basic-auth
 stringData:
-  username: otomi-admin
-  password: {{ .Values.giteaPassword }}
+  GITEA_USERNAME: otomi-admin
+  GITEA_PASSWORD: {{ .Values.giteaPassword }}

From 78cf3c967ae647bd4137f7f5d4293e18aa13b578 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 17:07:53 +0200
Subject: [PATCH 08/68] feat: update apl-chart

---
 charts/apl-operator/templates/deployment.yaml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index b73160fc1c..d76c505a7f 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -32,9 +32,8 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command:
-            - npm
-            - run
-            - apl-operator
+            - node
+            - dist/src/operator/main.js
           env:
             - name: RUN_AS_OPERATOR
               value: "true"

From 80dcce4d0dc2ff394b5c4aa99f7dcacabddf87ce Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 17:26:08 +0200
Subject: [PATCH 09/68] feat: update apl-chart

---
 charts/apl-operator/templates/secret.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/apl-operator/templates/secret.yaml b/charts/apl-operator/templates/secret.yaml
index f3dcf577cf..111773e8a3 100644
--- a/charts/apl-operator/templates/secret.yaml
+++ b/charts/apl-operator/templates/secret.yaml
@@ -41,7 +41,7 @@ kind: Secret
 metadata:
   name: gitea-credentials
   namespace: {{ .Release.Namespace }}
-type: kubernetes.io/basic-auth
+type: Opaque
 stringData:
   GITEA_USERNAME: otomi-admin
   GITEA_PASSWORD: {{ .Values.giteaPassword }}

From 677d002254706dfdba24ad836acfbe5df13f7f0d Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 18:31:36 +0200
Subject: [PATCH 10/68] feat: update apl-chart

---
 charts/apl-operator/templates/deployment.yaml | 2 --
 values/apl-operator/apl-operator.gotmpl       | 3 ---
 2 files changed, 5 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index d76c505a7f..1159419f49 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -37,8 +37,6 @@ spec:
           env:
             - name: RUN_AS_OPERATOR
               value: "true"
-            - name: ENV_DIR
-              value: "{{ .Values.env.ENV_DIR }}"
           envFrom:
             - secretRef:
                 name: gitea-credentials
diff --git a/values/apl-operator/apl-operator.gotmpl b/values/apl-operator/apl-operator.gotmpl
index 5e7dae3598..f0aa549d73 100644
--- a/values/apl-operator/apl-operator.gotmpl
+++ b/values/apl-operator/apl-operator.gotmpl
@@ -19,6 +19,3 @@ resources: {{- toYaml $o.resources.operator | nindent 2 }}
 kms: {{- $kms | toYaml | nindent 2 }}
 
 giteaPassword: {{ $g.adminPassword }}
-
-env:
-  ENV_DIR: /tmp/apl-operator/values

From 4196f526b94111722b319b27a157d51223e525ac Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 18:34:10 +0200
Subject: [PATCH 11/68] feat: update apl-chart

---
 src/operator/apl-operator.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 91188e3833..bf03324b99 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -9,13 +9,14 @@ import { module as bootstrapModule } from '../cmd/bootstrap'
 import { module as validateValuesModule } from '../cmd/validate-values'
 import { setValuesFile } from '../common/repo'
 import { waitTillGitRepoAvailable } from '../common/k8s'
+import { env } from '../common/envalid'
 
 export class AplOperator {
   private d = terminal('operator:apl')
   private isRunning = false
   private pollInterval = 1000
   private lastRevision = ''
-  private repoPath = '/tmp/apl-operator/values'
+  private repoPath = env.ENV_DIR
   private repoUrl: string
   private git: SimpleGit
 

From 4eb23f8ebb58668631fe3da1e6b03e4853bb3525 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 19:11:07 +0200
Subject: [PATCH 12/68] feat: update operator

---
 src/operator/apl-operator.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index bf03324b99..348f7f3768 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -28,13 +28,13 @@ export class AplOperator {
     //TODO change this when going in to cluster
     this.repoUrl = `https://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
 
-    // Remove the existing directory if it exists
-    if (fs.existsSync(this.repoPath)) {
+    // Remove the existing directory if it exists and is not empty
+    if (fs.existsSync(this.repoPath) && fs.readdirSync(this.repoPath).length > 0) {
       this.d.info('Removing existing repository directory')
       fs.rmSync(this.repoPath, { recursive: true, force: true })
     }
 
-    // Ensure parent directory exists
+    // Ensure directory exists
     if (!fs.existsSync(this.repoPath)) {
       fs.mkdirSync(this.repoPath, { recursive: true })
     }

From 71207aeae5f4bd5e46d9d368c2223e506c52b357 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Mon, 12 May 2025 19:23:09 +0200
Subject: [PATCH 13/68] feat: update operator

---
 src/operator/apl-operator.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 348f7f3768..d25a69fddc 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -10,6 +10,7 @@ import { module as validateValuesModule } from '../cmd/validate-values'
 import { setValuesFile } from '../common/repo'
 import { waitTillGitRepoAvailable } from '../common/k8s'
 import { env } from '../common/envalid'
+import path from 'path'
 
 export class AplOperator {
   private d = terminal('operator:apl')
@@ -33,8 +34,11 @@ export class AplOperator {
       this.d.info('Removing existing repository directory')
       fs.rmSync(this.repoPath, { recursive: true, force: true })
     }
+    const parentDir = path.dirname(this.repoPath)
+    if (!fs.existsSync(parentDir)) {
+      fs.mkdirSync(parentDir, { recursive: true })
+    }
 
-    // Ensure directory exists
     if (!fs.existsSync(this.repoPath)) {
       fs.mkdirSync(this.repoPath, { recursive: true })
     }

From 07bcf24813f6942dff8960f0097e82e815d36dbf Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 08:07:22 +0200
Subject: [PATCH 14/68] feat: update operator

---
 src/operator/apl-operator.ts | 18 ++----------------
 src/operator/main.ts         | 14 ++++----------
 2 files changed, 6 insertions(+), 26 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index d25a69fddc..1dc2b0053a 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -21,27 +21,13 @@ export class AplOperator {
   private repoUrl: string
   private git: SimpleGit
 
-  constructor(username: string, password: string, giteaUrl: string, pollIntervalMs?: number) {
+  constructor(username: string, password: string, giteaUrl: string, giteaProtocol: string, pollIntervalMs?: number) {
     this.pollInterval = pollIntervalMs ? pollIntervalMs : this.pollInterval
 
     const giteaOrg = 'otomi'
     const giteaRepo = 'values'
     //TODO change this when going in to cluster
-    this.repoUrl = `https://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
-
-    // Remove the existing directory if it exists and is not empty
-    if (fs.existsSync(this.repoPath) && fs.readdirSync(this.repoPath).length > 0) {
-      this.d.info('Removing existing repository directory')
-      fs.rmSync(this.repoPath, { recursive: true, force: true })
-    }
-    const parentDir = path.dirname(this.repoPath)
-    if (!fs.existsSync(parentDir)) {
-      fs.mkdirSync(parentDir, { recursive: true })
-    }
-
-    if (!fs.existsSync(this.repoPath)) {
-      fs.mkdirSync(this.repoPath, { recursive: true })
-    }
+    this.repoUrl = `${giteaProtocol}://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
 
     this.git = simpleGit({
       baseDir: this.repoPath,
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 942693109a..b69a9bb401 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -4,7 +4,6 @@ import { AplOperator } from './apl-operator'
 import { operatorEnv } from './validators'
 import { env } from '../common/envalid'
 
-// Load environment variables
 dotenv.config()
 
 const d = terminal('operator:main')
@@ -13,22 +12,23 @@ interface OperatorConfig {
   giteaUsername: string
   giteaPassword: string
   giteaUrl: string
+  giteaProtocol: string
 }
 
-// Load configuration from environment variables
 function loadConfig(): OperatorConfig {
   const giteaUsername = operatorEnv.GITEA_USERNAME
   const giteaPassword = operatorEnv.GITEA_PASSWORD
   const giteaUrl = env.GITEA_URL
+  const giteaProtocol = env.GITEA_PROTOCOL
 
   return {
     giteaUsername,
     giteaPassword,
     giteaUrl,
+    giteaProtocol,
   }
 }
 
-// Gracefully handle termination signals
 function handleTerminationSignals(operator: AplOperator): void {
   function exitHandler(signal: string) {
     d.info(`Received ${signal}, shutting down...`)
@@ -40,21 +40,16 @@ function handleTerminationSignals(operator: AplOperator): void {
   process.on('SIGINT', () => exitHandler('SIGINT'))
 }
 
-// Main function
 async function main(): Promise<void> {
   try {
     d.info('Starting APL Operator')
 
-    // Load configuration
     const config = loadConfig()
 
-    // Create and start the Gitea operator
-    const operator = new AplOperator(config.giteaUsername, config.giteaPassword, config.giteaUrl)
+    const operator = new AplOperator(config.giteaUsername, config.giteaPassword, config.giteaUrl, config.giteaProtocol)
 
-    // Set up signal handlers
     handleTerminationSignals(operator)
 
-    // Start the operator
     await operator.start()
 
     d.info('APL Operator started successfully')
@@ -64,7 +59,6 @@ async function main(): Promise<void> {
   }
 }
 
-// Run the main function if this file is executed directly
 if (require.main === module) {
   main().catch((error) => {
     d.error('Unhandled error in main:', error)

From 626181bfdae16853293dd6c7ba6e4a5d2e7db520 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 09:42:57 +0200
Subject: [PATCH 15/68] feat: set correct env dir

---
 charts/apl-operator/templates/deployment.yaml |  6 +++++
 src/operator/apl-operator.ts                  | 13 ++++++---
 src/operator/main.ts                          | 27 ++++++++++++++++++-
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index 1159419f49..c0916c2a2e 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -44,6 +44,12 @@ spec:
                 name: apl-sops-secrets
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: apl-values
+              mountPath: /home/app/stack/env
+      volumes:
+        - name: apl-values
+          emptyDir: {}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 1dc2b0053a..063bfc2e1c 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -17,13 +17,20 @@ export class AplOperator {
   private isRunning = false
   private pollInterval = 1000
   private lastRevision = ''
-  private repoPath = env.ENV_DIR
+  private repoPath: string
   private repoUrl: string
   private git: SimpleGit
 
-  constructor(username: string, password: string, giteaUrl: string, giteaProtocol: string, pollIntervalMs?: number) {
+  constructor(
+    username: string,
+    password: string,
+    giteaUrl: string,
+    giteaProtocol: string,
+    repoPath: string,
+    pollIntervalMs?: number,
+  ) {
     this.pollInterval = pollIntervalMs ? pollIntervalMs : this.pollInterval
-
+    this.repoUrl = repoPath
     const giteaOrg = 'otomi'
     const giteaRepo = 'values'
     //TODO change this when going in to cluster
diff --git a/src/operator/main.ts b/src/operator/main.ts
index b69a9bb401..6f046fff4d 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -3,6 +3,8 @@ import { terminal } from '../common/debug'
 import { AplOperator } from './apl-operator'
 import { operatorEnv } from './validators'
 import { env } from '../common/envalid'
+import fs from 'fs'
+import path from 'path'
 
 dotenv.config()
 
@@ -13,6 +15,7 @@ interface OperatorConfig {
   giteaPassword: string
   giteaUrl: string
   giteaProtocol: string
+  repoPath: string
 }
 
 function loadConfig(): OperatorConfig {
@@ -20,12 +23,14 @@ function loadConfig(): OperatorConfig {
   const giteaPassword = operatorEnv.GITEA_PASSWORD
   const giteaUrl = env.GITEA_URL
   const giteaProtocol = env.GITEA_PROTOCOL
+  const repoPath = env.ENV_DIR
 
   return {
     giteaUsername,
     giteaPassword,
     giteaUrl,
     giteaProtocol,
+    repoPath,
   }
 }
 
@@ -45,8 +50,28 @@ async function main(): Promise<void> {
     d.info('Starting APL Operator')
 
     const config = loadConfig()
+    const repoPath = env.ENV_DIR
+    // Remove the existing directory if it exists and is not empty
+    if (fs.existsSync(repoPath) && fs.readdirSync(repoPath).length > 0) {
+      this.d.info('Removing existing repository directory')
+      fs.rmSync(repoPath, { recursive: true, force: true })
+    }
+    const parentDir = path.dirname(repoPath)
+    if (!fs.existsSync(parentDir)) {
+      fs.mkdirSync(parentDir, { recursive: true })
+    }
 
-    const operator = new AplOperator(config.giteaUsername, config.giteaPassword, config.giteaUrl, config.giteaProtocol)
+    if (!fs.existsSync(repoPath)) {
+      fs.mkdirSync(repoPath, { recursive: true })
+    }
+
+    const operator = new AplOperator(
+      config.giteaUsername,
+      config.giteaPassword,
+      config.giteaUrl,
+      config.giteaProtocol,
+      config.repoPath,
+    )
 
     handleTerminationSignals(operator)
 

From d327ebb3695c5e011cf3fdc828a8621300ee935a Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 10:11:15 +0200
Subject: [PATCH 16/68] feat: set repoPath correctly

---
 src/operator/apl-operator.ts |  2 +-
 src/operator/main.ts         | 11 +++++------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 063bfc2e1c..e7bcdbe4fc 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -30,7 +30,7 @@ export class AplOperator {
     pollIntervalMs?: number,
   ) {
     this.pollInterval = pollIntervalMs ? pollIntervalMs : this.pollInterval
-    this.repoUrl = repoPath
+    this.repoPath = repoPath
     const giteaOrg = 'otomi'
     const giteaRepo = 'values'
     //TODO change this when going in to cluster
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 6f046fff4d..4b6a90d95d 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -50,19 +50,18 @@ async function main(): Promise<void> {
     d.info('Starting APL Operator')
 
     const config = loadConfig()
-    const repoPath = env.ENV_DIR
     // Remove the existing directory if it exists and is not empty
-    if (fs.existsSync(repoPath) && fs.readdirSync(repoPath).length > 0) {
+    if (fs.existsSync(config.repoPath) && fs.readdirSync(config.repoPath).length > 0) {
       this.d.info('Removing existing repository directory')
-      fs.rmSync(repoPath, { recursive: true, force: true })
+      fs.rmSync(config.repoPath, { recursive: true, force: true })
     }
-    const parentDir = path.dirname(repoPath)
+    const parentDir = path.dirname(config.repoPath)
     if (!fs.existsSync(parentDir)) {
       fs.mkdirSync(parentDir, { recursive: true })
     }
 
-    if (!fs.existsSync(repoPath)) {
-      fs.mkdirSync(repoPath, { recursive: true })
+    if (!fs.existsSync(config.repoPath)) {
+      fs.mkdirSync(config.repoPath, { recursive: true })
     }
 
     const operator = new AplOperator(

From 41681bba2a3a08aecdf03a26beb465680d9feab6 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 10:21:23 +0200
Subject: [PATCH 17/68] fix: errors in main

---
 src/operator/apl-operator.ts | 2 --
 src/operator/main.ts         | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index e7bcdbe4fc..30255e9776 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -120,7 +120,6 @@ export class AplOperator {
     this.d.info('Executing bootstrap process')
 
     try {
-      process.env.ENV_DIR = this.repoPath
       await bootstrapModule.handler({} as HelmArguments)
       await setValuesFile(this.repoPath)
       this.d.info('Bootstrap completed successfully')
@@ -135,7 +134,6 @@ export class AplOperator {
 
     try {
       // Execute validate-values command
-      process.env.ENV_DIR = this.repoPath
       await validateValuesModule.handler({} as HelmArguments)
       this.d.info('Values validation completed successfully')
     } catch (error) {
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 4b6a90d95d..b54836190f 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -52,7 +52,7 @@ async function main(): Promise<void> {
     const config = loadConfig()
     // Remove the existing directory if it exists and is not empty
     if (fs.existsSync(config.repoPath) && fs.readdirSync(config.repoPath).length > 0) {
-      this.d.info('Removing existing repository directory')
+      d.info('Removing existing repository directory')
       fs.rmSync(config.repoPath, { recursive: true, force: true })
     }
     const parentDir = path.dirname(config.repoPath)

From 6f7634acf52ef2e5cd2c640b1b69e269576ce18f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 10:45:16 +0200
Subject: [PATCH 18/68] fix: errors in main

---
 src/operator/main.ts | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/operator/main.ts b/src/operator/main.ts
index b54836190f..9c2acf4310 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -50,10 +50,13 @@ async function main(): Promise<void> {
     d.info('Starting APL Operator')
 
     const config = loadConfig()
-    // Remove the existing directory if it exists and is not empty
-    if (fs.existsSync(config.repoPath) && fs.readdirSync(config.repoPath).length > 0) {
-      d.info('Removing existing repository directory')
-      fs.rmSync(config.repoPath, { recursive: true, force: true })
+    // Only delete contents of the directory
+    if (fs.existsSync(config.repoPath)) {
+      d.info(`Clearing directory contents of ${config.repoPath}`)
+      for (const entry of fs.readdirSync(config.repoPath)) {
+        const entryPath = path.join(config.repoPath, entry)
+        fs.rmSync(entryPath, { recursive: true, force: true })
+      }
     }
     const parentDir = path.dirname(config.repoPath)
     if (!fs.existsSync(parentDir)) {

From 6d17b32e6d97ee5abe03fb5357fe9d91b87bc028 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 11:19:33 +0200
Subject: [PATCH 19/68] feat: add safe directory for git

---
 src/operator/apl-operator.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 30255e9776..dca159b41f 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -45,6 +45,7 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
+    await this.git.raw(['config', '--global', '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {

From a836bce3524f66532474b1b5ee5f9cdae08bba7b Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 11:32:17 +0200
Subject: [PATCH 20/68] feat: add safe directory for git

---
 src/operator/apl-operator.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index dca159b41f..c378cb1ca9 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -45,7 +45,7 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw(['config', '--global', '--add', 'safe.directory', this.repoPath])
+    await this.git.raw(['config', '--file', '/home/app/stack', '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {

From 31946f339baccf4ca06f36f138710aa69a17cfe4 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 11:42:12 +0200
Subject: [PATCH 21/68] feat: add safe directory for git

---
 src/operator/apl-operator.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index c378cb1ca9..627509a80c 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -45,7 +45,7 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw(['config', '--file', '/home/app/stack', '--add', 'safe.directory', this.repoPath])
+    await this.git.raw(['config', '--file', this.repoPath, '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {

From a69e459fa6294bae43e843dc1631ca5132c25913 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 11:49:14 +0200
Subject: [PATCH 22/68] feat: add safe directory for git

---
 src/operator/apl-operator.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 627509a80c..245fbce1b3 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -45,7 +45,9 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw(['config', '--file', this.repoPath, '--add', 'safe.directory', this.repoPath])
+    const gitConfigPath = path.join(this.repoPath, '.gitconfig')
+    process.env.GIT_CONFIG_GLOBAL = gitConfigPath
+    await this.git.raw(['config', '--file', gitConfigPath, '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {

From 0b60ef210c0e7f9ce61a2070c63865d01bf73430 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 12:35:32 +0200
Subject: [PATCH 23/68] feat: add safe directory for git

---
 charts/apl-operator/templates/deployment.yaml | 2 +-
 src/operator/apl-operator.ts                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index c0916c2a2e..49fa32db45 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -46,7 +46,7 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
             - name: apl-values
-              mountPath: /home/app/stack/env
+              mountPath: /home/app/stack
       volumes:
         - name: apl-values
           emptyDir: {}
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 245fbce1b3..5c03443c72 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -45,7 +45,7 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    const gitConfigPath = path.join(this.repoPath, '.gitconfig')
+    const gitConfigPath = path.join('/home/app/stack', '.gitconfig')
     process.env.GIT_CONFIG_GLOBAL = gitConfigPath
     await this.git.raw(['config', '--file', gitConfigPath, '--add', 'safe.directory', this.repoPath])
   }

From b7bb31cbaa32b4b681a5f41c1c7333286aca3e3f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 13:12:58 +0200
Subject: [PATCH 24/68] feat: add safe directory for git

---
 charts/apl-operator/templates/deployment.yaml | 6 +++++-
 src/operator/apl-operator.ts                  | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index 49fa32db45..0f972f1c68 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -46,10 +46,14 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
             - name: apl-values
-              mountPath: /home/app/stack
+              mountPath: /home/app/stack/env
+            - name: git-config
+              mountPath: /home/app/stack/gitconfig
       volumes:
         - name: apl-values
           emptyDir: {}
+        - name: git-config
+          emptyDir: {}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 5c03443c72..9b13341eaa 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -45,7 +45,7 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    const gitConfigPath = path.join('/home/app/stack', '.gitconfig')
+    const gitConfigPath = path.join('/home/app/stack/gitconfig', '.gitconfig')
     process.env.GIT_CONFIG_GLOBAL = gitConfigPath
     await this.git.raw(['config', '--file', gitConfigPath, '--add', 'safe.directory', this.repoPath])
   }

From 65f6b0fa14ac4f9049aa16d7cae7919fa42f3049 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 14:37:29 +0200
Subject: [PATCH 25/68] feat: add safe directory for git

---
 src/operator/apl-operator.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 9b13341eaa..bcf815a29a 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -1,6 +1,5 @@
 import simpleGit, { SimpleGit } from 'simple-git'
 import { terminal } from '../common/debug'
-import * as fs from 'fs'
 import { HelmArguments } from '../common/yargs'
 
 import { module as applyModule } from '../cmd/apply'
@@ -9,8 +8,8 @@ import { module as bootstrapModule } from '../cmd/bootstrap'
 import { module as validateValuesModule } from '../cmd/validate-values'
 import { setValuesFile } from '../common/repo'
 import { waitTillGitRepoAvailable } from '../common/k8s'
-import { env } from '../common/envalid'
 import path from 'path'
+import { $ } from 'zx'
 
 export class AplOperator {
   private d = terminal('operator:apl')
@@ -54,6 +53,7 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
+      await $`ls -la ./env`
       await this.git.clone(this.repoUrl, this.repoPath)
 
       const log = await this.git.log({ maxCount: 1 })

From 461c24a1fca6534d5ccf170aff035ad708fe0a37 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 15:09:00 +0200
Subject: [PATCH 26/68] feat: add logs

---
 src/operator/apl-operator.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index bcf815a29a..13967b792c 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -53,7 +53,8 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
-      await $`ls -la ./env`
+      await $`pwd`
+      await $`ls -la`
       await this.git.clone(this.repoUrl, this.repoPath)
 
       const log = await this.git.log({ maxCount: 1 })

From d85742cb2a68283b29c0888154c8f1b136a32661 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 15:38:36 +0200
Subject: [PATCH 27/68] feat: add logs

---
 src/operator/apl-operator.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 13967b792c..48472b8a79 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -44,9 +44,7 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    const gitConfigPath = path.join('/home/app/stack/gitconfig', '.gitconfig')
-    process.env.GIT_CONFIG_GLOBAL = gitConfigPath
-    await this.git.raw(['config', '--file', gitConfigPath, '--add', 'safe.directory', this.repoPath])
+    await this.git.raw(['config', '--global', '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {

From ffaaa37b16ce21a5a1e41488d03fa00d80b3564a Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 15:43:02 +0200
Subject: [PATCH 28/68] feat: add logs

---
 src/operator/apl-operator.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 48472b8a79..88e8f49766 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -51,8 +51,6 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
-      await $`pwd`
-      await $`ls -la`
       await this.git.clone(this.repoUrl, this.repoPath)
 
       const log = await this.git.log({ maxCount: 1 })

From fe71e751d6719487c21d7360be49733c97e7ddb9 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 16:12:51 +0200
Subject: [PATCH 29/68] feat: add logs

---
 src/operator/apl-operator.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 88e8f49766..fea4c3756d 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -44,7 +44,15 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw(['config', '--global', '--add', 'safe.directory', this.repoPath])
+    await this.git.raw([
+      'config',
+      '--global',
+      '--file',
+      '/home/app/stack/gitconfig',
+      '--add',
+      'safe.directory',
+      this.repoPath,
+    ])
   }
 
   private async cloneRepository(): Promise<void> {

From 5149b4adf4c4f0abb2665d56774219dbc315f018 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 16:26:32 +0200
Subject: [PATCH 30/68] feat: add logs

---
 src/operator/apl-operator.ts | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index fea4c3756d..6ca6c97d99 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -44,21 +44,21 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw([
-      'config',
-      '--global',
-      '--file',
-      '/home/app/stack/gitconfig',
-      '--add',
-      'safe.directory',
-      this.repoPath,
-    ])
+    await this.git.raw(['config', '--file', '/home/app/stack/gitconfig', '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
+      const listRoot = await $`ls -la`.nothrow()
+      this.d.log('ls -la:\n', listRoot.stdout)
+
+      const listEnv = await $`ls -la ./env`.nothrow()
+      this.d.log('ls -la ./env:\n', listEnv.stdout)
+
+      const currentDir = await $`pwd`.nothrow()
+      this.d.log('pwd:\n', currentDir.stdout)
       await this.git.clone(this.repoUrl, this.repoPath)
 
       const log = await this.git.log({ maxCount: 1 })

From b28acb366f8393566a958a69f69916e2c022f1ee Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 16:32:23 +0200
Subject: [PATCH 31/68] feat: add logs

---
 src/operator/apl-operator.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 6ca6c97d99..8c575866af 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -44,7 +44,14 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw(['config', '--file', '/home/app/stack/gitconfig', '--add', 'safe.directory', this.repoPath])
+    await this.git.raw([
+      'config',
+      '--file',
+      '/home/app/stack/gitconfig/.gitconfig',
+      '--add',
+      'safe.directory',
+      this.repoPath,
+    ])
   }
 
   private async cloneRepository(): Promise<void> {

From 193704f1f5c7b06dc07e8cfccc4563b551034617 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 16:42:17 +0200
Subject: [PATCH 32/68] feat: add logs

---
 src/operator/apl-operator.ts | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 8c575866af..608a21fa7e 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -44,14 +44,9 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    await this.git.raw([
-      'config',
-      '--file',
-      '/home/app/stack/gitconfig/.gitconfig',
-      '--add',
-      'safe.directory',
-      this.repoPath,
-    ])
+    const gitConfig = '/home/app/stack/gitconfig/.gitconfig'
+    process.env.GIT_CONFIG_GLOBAL = gitConfig
+    await this.git.raw(['config', '--file', gitConfig, '--add', 'safe.directory', this.repoPath])
   }
 
   private async cloneRepository(): Promise<void> {

From 4efb26eee0d0301b560665232b043c526919d570 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 16:54:40 +0200
Subject: [PATCH 33/68] feat: add logs

---
 src/operator/apl-operator.ts | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 608a21fa7e..ea7441214a 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -44,9 +44,19 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    const gitConfig = '/home/app/stack/gitconfig/.gitconfig'
-    process.env.GIT_CONFIG_GLOBAL = gitConfig
-    await this.git.raw(['config', '--file', gitConfig, '--add', 'safe.directory', this.repoPath])
+    const gitConfigDir = '/home/app/stack/gitconfig'
+    const gitConfigFile = `${gitConfigDir}/.gitconfig`
+
+    // Set this to be used for all git commands
+    process.env.GIT_CONFIG_GLOBAL = gitConfigFile
+
+    // Set the Git safe directory using the raw git command
+    this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
+    await this.git.raw(['config', '--global', '--add', 'safe.directory', this.repoPath])
+
+    // Verify the configuration was set
+    const config = await this.git.raw(['config', '--global', '--get', 'safe.directory'])
+    this.d.info(`Git safe.directory is set to: ${config.trim()}`)
   }
 
   private async cloneRepository(): Promise<void> {
@@ -56,9 +66,6 @@ export class AplOperator {
       const listRoot = await $`ls -la`.nothrow()
       this.d.log('ls -la:\n', listRoot.stdout)
 
-      const listEnv = await $`ls -la ./env`.nothrow()
-      this.d.log('ls -la ./env:\n', listEnv.stdout)
-
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
       await this.git.clone(this.repoUrl, this.repoPath)

From 1236a89d9e14ea2b4940affb4c912a203a03b6bd Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 17:03:33 +0200
Subject: [PATCH 34/68] feat: add logs

---
 src/operator/apl-operator.ts | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index ea7441214a..e41b245f25 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -34,7 +34,11 @@ export class AplOperator {
     const giteaRepo = 'values'
     //TODO change this when going in to cluster
     this.repoUrl = `${giteaProtocol}://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
+    const gitConfigDir = '/home/app/stack/gitconfig'
+    const gitConfigFile = `${gitConfigDir}/.gitconfig`
 
+    // Set this to be used for all git commands
+    process.env.GIT_CONFIG_GLOBAL = gitConfigFile
     this.git = simpleGit({
       baseDir: this.repoPath,
     })
@@ -44,11 +48,6 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-    const gitConfigDir = '/home/app/stack/gitconfig'
-    const gitConfigFile = `${gitConfigDir}/.gitconfig`
-
-    // Set this to be used for all git commands
-    process.env.GIT_CONFIG_GLOBAL = gitConfigFile
 
     // Set the Git safe directory using the raw git command
     this.d.info(`Setting Git safe.directory to ${this.repoPath}`)

From e2455c4185e361b7d2757edfb0f99b20f8596138 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 17:10:09 +0200
Subject: [PATCH 35/68] feat: add logs

---
 src/operator/apl-operator.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index e41b245f25..1f00925982 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -51,7 +51,7 @@ export class AplOperator {
 
     // Set the Git safe directory using the raw git command
     this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
-    await this.git.raw(['config', '--global', '--add', 'safe.directory', this.repoPath])
+    await this.git.raw(['config', '--system', '--add', 'safe.directory', this.repoPath])
 
     // Verify the configuration was set
     const config = await this.git.raw(['config', '--global', '--get', 'safe.directory'])

From 2fe9a56f7f7433152da2c7f205c5935c551ef4c6 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 17:17:06 +0200
Subject: [PATCH 36/68] feat: add logs

---
 src/operator/apl-operator.ts | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 1f00925982..0c41e20162 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -34,11 +34,7 @@ export class AplOperator {
     const giteaRepo = 'values'
     //TODO change this when going in to cluster
     this.repoUrl = `${giteaProtocol}://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
-    const gitConfigDir = '/home/app/stack/gitconfig'
-    const gitConfigFile = `${gitConfigDir}/.gitconfig`
 
-    // Set this to be used for all git commands
-    process.env.GIT_CONFIG_GLOBAL = gitConfigFile
     this.git = simpleGit({
       baseDir: this.repoPath,
     })
@@ -48,14 +44,6 @@ export class AplOperator {
 
   private async waitForGitea(): Promise<void> {
     await waitTillGitRepoAvailable(this.repoUrl)
-
-    // Set the Git safe directory using the raw git command
-    this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
-    await this.git.raw(['config', '--system', '--add', 'safe.directory', this.repoPath])
-
-    // Verify the configuration was set
-    const config = await this.git.raw(['config', '--global', '--get', 'safe.directory'])
-    this.d.info(`Git safe.directory is set to: ${config.trim()}`)
   }
 
   private async cloneRepository(): Promise<void> {
@@ -67,7 +55,7 @@ export class AplOperator {
 
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
-      await this.git.clone(this.repoUrl, this.repoPath)
+      await this.git.clone(this.repoUrl)
 
       const log = await this.git.log({ maxCount: 1 })
       this.lastRevision = log.latest?.hash || ''

From 6a9f0ff8c54fd2886b69e5552c180970542922c3 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 17:26:16 +0200
Subject: [PATCH 37/68] feat: add logs

---
 src/operator/apl-operator.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 0c41e20162..f422fa9b52 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -55,7 +55,7 @@ export class AplOperator {
 
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
-      await this.git.clone(this.repoUrl)
+      await this.git.clone(this.repoUrl, this.repoPath, ['-c', `safe.directory=${this.repoPath}`])
 
       const log = await this.git.log({ maxCount: 1 })
       this.lastRevision = log.latest?.hash || ''

From 4bda084cd9893178daca8f8a7ad3840a88c785d2 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 17:33:02 +0200
Subject: [PATCH 38/68] feat: add logs

---
 src/operator/apl-operator.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index f422fa9b52..62c4f58698 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -57,8 +57,8 @@ export class AplOperator {
       this.d.log('pwd:\n', currentDir.stdout)
       await this.git.clone(this.repoUrl, this.repoPath, ['-c', `safe.directory=${this.repoPath}`])
 
-      const log = await this.git.log({ maxCount: 1 })
-      this.lastRevision = log.latest?.hash || ''
+      const hash = await this.git.revparse('HEAD')
+      this.lastRevision = hash || ''
 
       this.d.info(`Repository cloned successfully, current revision: ${this.lastRevision}`)
     } catch (error) {

From ea3eebfc0b2d377e98f3d50ebaa4f4d595d2e3fd Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 20:18:57 +0200
Subject: [PATCH 39/68] feat: add logs

---
 src/operator/apl-operator.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 62c4f58698..74cbfbc0ca 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -56,9 +56,10 @@ export class AplOperator {
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
       await this.git.clone(this.repoUrl, this.repoPath, ['-c', `safe.directory=${this.repoPath}`])
-
-      const hash = await this.git.revparse('HEAD')
-      this.lastRevision = hash || ''
+      this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
+      await this.git.raw(['config', '--local', '--add', 'safe.directory', '*'])
+      const log = await this.git.log({ maxCount: 1 })
+      this.lastRevision = log.latest?.hash || ''
 
       this.d.info(`Repository cloned successfully, current revision: ${this.lastRevision}`)
     } catch (error) {

From 7d9789d1ac3168b707c6f540480a6d02b88127be Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Tue, 13 May 2025 20:33:17 +0200
Subject: [PATCH 40/68] feat: add logs

---
 src/operator/apl-operator.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 74cbfbc0ca..8a658ea866 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -50,13 +50,13 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
+      await this.git.clone(this.repoUrl, this.repoPath, ['-c', `safe.directory=${this.repoPath}`])
+      this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
       const listRoot = await $`ls -la`.nothrow()
       this.d.log('ls -la:\n', listRoot.stdout)
 
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
-      await this.git.clone(this.repoUrl, this.repoPath, ['-c', `safe.directory=${this.repoPath}`])
-      this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
       await this.git.raw(['config', '--local', '--add', 'safe.directory', '*'])
       const log = await this.git.log({ maxCount: 1 })
       this.lastRevision = log.latest?.hash || ''

From cceb1c560a17e7d5c65d69b33d21c21962b2b9ac Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 08:32:42 +0200
Subject: [PATCH 41/68] feat: test without clone repository

---
 src/operator/apl-operator.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 8a658ea866..4754f3b278 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -227,8 +227,6 @@ export class AplOperator {
     try {
       await this.waitForGitea()
 
-      await this.cloneRepository()
-
       await this.executeBootstrap()
 
       await this.executeValidateValues()

From bc8d9f26631784b49abc9c70b29ac1c0075d2bdd Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 08:58:29 +0200
Subject: [PATCH 42/68] feat: use tmp directory

---
 charts/apl-operator/templates/deployment.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index 0f972f1c68..edcbd67a33 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -47,12 +47,12 @@ spec:
           volumeMounts:
             - name: apl-values
               mountPath: /home/app/stack/env
-            - name: git-config
-              mountPath: /home/app/stack/gitconfig
+            - name: tmp
+              mountPath: /tmp
       volumes:
         - name: apl-values
           emptyDir: {}
-        - name: git-config
+        - name: tmp
           emptyDir: {}
       {{- with .Values.nodeSelector }}
       nodeSelector:

From a0f1ad38b5f4438161a652db80356b9bc3c469f7 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 09:28:31 +0200
Subject: [PATCH 43/68] fix: remove core label

---
 helmfile.d/helmfile-03.init.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/helmfile.d/helmfile-03.init.yaml b/helmfile.d/helmfile-03.init.yaml
index 7481eb9bef..156340a275 100644
--- a/helmfile.d/helmfile-03.init.yaml
+++ b/helmfile.d/helmfile-03.init.yaml
@@ -80,7 +80,6 @@ releases:
     namespace: apl-operator
     labels:
       pkg: apl-operator
-      app: core
     <<: *default
   - name: kiali-operator-artifacts
     installed: {{ $a | get "kiali.enabled" }}

From c675bd2cdd0f0c4bff262158a264f6728d9e7945 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 11:20:45 +0200
Subject: [PATCH 44/68] fix: add back core label

---
 helmfile.d/helmfile-03.init.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/helmfile.d/helmfile-03.init.yaml b/helmfile.d/helmfile-03.init.yaml
index 156340a275..7481eb9bef 100644
--- a/helmfile.d/helmfile-03.init.yaml
+++ b/helmfile.d/helmfile-03.init.yaml
@@ -80,6 +80,7 @@ releases:
     namespace: apl-operator
     labels:
       pkg: apl-operator
+      app: core
     <<: *default
   - name: kiali-operator-artifacts
     installed: {{ $a | get "kiali.enabled" }}

From 5ebdaded5e2a37f782c8ef40e4f96cee07b6d9ba Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 12:28:09 +0200
Subject: [PATCH 45/68] fix: fix bootstrap

---
 charts/apl-operator/templates/deployment.yaml | 1 +
 src/cmd/apply.ts                              | 3 ++-
 src/common/bootstrap.ts                       | 4 +++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index edcbd67a33..c4f9659aaa 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -31,6 +31,7 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          workingDir: /home/app/stack
           command:
             - node
             - dist/src/operator/main.js
diff --git a/src/cmd/apply.ts b/src/cmd/apply.ts
index e4b7e52167..ea0a9e7180 100644
--- a/src/cmd/apply.ts
+++ b/src/cmd/apply.ts
@@ -122,7 +122,8 @@ const applyAll = async () => {
         { streams: { stdout: d.stream.log, stderr: d.stream.error } },
       )
       await cloneOtomiChartsInGitea()
-      await retryCheckingForPipelineRun()
+      // Change this to check if apl-operator successfully deployed
+      // retryCheckingForPipelineRun()
       await retryIsOAuth2ProxyRunning()
       await printWelcomeMessage()
     }
diff --git a/src/common/bootstrap.ts b/src/common/bootstrap.ts
index 4fc659a19b..280c0d36bb 100644
--- a/src/common/bootstrap.ts
+++ b/src/common/bootstrap.ts
@@ -72,8 +72,10 @@ export const bootstrapGit = async (inValues?: Record<string, any>): Promise<void
   }
 
   if (isCli) {
-    await copyFile(`${rootDir}/bin/hooks/pre-commit`, `${env.ENV_DIR}/.git/hooks/pre-commit`)
+    d.info('Copying pre-commit hook')
+    // await copyFile(`${rootDir}/bin/hooks/pre-commit`, `${env.ENV_DIR}/.git/hooks/pre-commit`)
   } else {
+    d.info('setting git config')
     await $`git config --global --add safe.directory ${env.ENV_DIR}`.nothrow().quiet()
   }
 

From b19578bddb60fcb2fc38ef2ee20a6bf9d3a35ae8 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 16:05:41 +0200
Subject: [PATCH 46/68] fix: operator

---
 src/operator/apl-operator.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 4754f3b278..3d0b29a6ee 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -57,7 +57,8 @@ export class AplOperator {
 
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
-      await this.git.raw(['config', '--local', '--add', 'safe.directory', '*'])
+      this.d.info('setting git config')
+      await $`git config --global --add safe.directory ${this.repoPath}`.nothrow().quiet()
       const log = await this.git.log({ maxCount: 1 })
       this.lastRevision = log.latest?.hash || ''
 
@@ -126,7 +127,6 @@ export class AplOperator {
 
     try {
       await bootstrapModule.handler({} as HelmArguments)
-      await setValuesFile(this.repoPath)
       this.d.info('Bootstrap completed successfully')
     } catch (error) {
       this.d.error('Bootstrap failed:', error)

From 4dd10f2d15af3ea0f151de78065b14eb58b3052b Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 19:02:09 +0200
Subject: [PATCH 47/68] fix: add git clone back

---
 src/operator/apl-operator.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 3d0b29a6ee..fce8d15f35 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -226,6 +226,7 @@ export class AplOperator {
 
     try {
       await this.waitForGitea()
+      await this.cloneRepository()
 
       await this.executeBootstrap()
 

From d3a6f10f1a5cc534896aa16b5fb122c2265bc93e Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 19:22:13 +0200
Subject: [PATCH 48/68] fix: remove simple git

---
 src/operator/apl-operator.ts | 56 +++++++++++-------------------------
 1 file changed, 16 insertions(+), 40 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index fce8d15f35..9b111fdde5 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -1,4 +1,3 @@
-import simpleGit, { SimpleGit } from 'simple-git'
 import { terminal } from '../common/debug'
 import { HelmArguments } from '../common/yargs'
 
@@ -6,9 +5,7 @@ import { module as applyModule } from '../cmd/apply'
 import { module as applyAsAppsModule } from '../cmd/apply-as-apps'
 import { module as bootstrapModule } from '../cmd/bootstrap'
 import { module as validateValuesModule } from '../cmd/validate-values'
-import { setValuesFile } from '../common/repo'
 import { waitTillGitRepoAvailable } from '../common/k8s'
-import path from 'path'
 import { $ } from 'zx'
 
 export class AplOperator {
@@ -18,7 +15,6 @@ export class AplOperator {
   private lastRevision = ''
   private repoPath: string
   private repoUrl: string
-  private git: SimpleGit
 
   constructor(
     username: string,
@@ -35,10 +31,6 @@ export class AplOperator {
     //TODO change this when going in to cluster
     this.repoUrl = `${giteaProtocol}://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
 
-    this.git = simpleGit({
-      baseDir: this.repoPath,
-    })
-
     this.d.info(`Initialized APL operator with repo URL: ${this.repoUrl.replace(password, '***')}`)
   }
 
@@ -50,7 +42,7 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
-      await this.git.clone(this.repoUrl, this.repoPath, ['-c', `safe.directory=${this.repoPath}`])
+      await $`git clone ${this.repoUrl} ${this.repoPath}`.nothrow().quiet()
       this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
       const listRoot = await $`ls -la`.nothrow()
       this.d.log('ls -la:\n', listRoot.stdout)
@@ -59,8 +51,9 @@ export class AplOperator {
       this.d.log('pwd:\n', currentDir.stdout)
       this.d.info('setting git config')
       await $`git config --global --add safe.directory ${this.repoPath}`.nothrow().quiet()
-      const log = await this.git.log({ maxCount: 1 })
-      this.lastRevision = log.latest?.hash || ''
+      const result = await $`git log -1 --pretty=format:"%H"`.quiet()
+      const commitHash = result.stdout.trim()
+      this.lastRevision = commitHash || ''
 
       this.d.info(`Repository cloned successfully, current revision: ${this.lastRevision}`)
     } catch (error) {
@@ -69,45 +62,29 @@ export class AplOperator {
     }
   }
 
-  private async shouldSkipCommit(commitHash: string): Promise<boolean> {
-    try {
-      const logResult = await this.git.log({ maxCount: 1, from: commitHash, to: commitHash })
-
-      if (!logResult.latest) {
-        return false
-      }
-
-      const commitMessage = logResult.latest.message || ''
-      const skipMarker = '[ci skip]'
-
-      const shouldSkip = commitMessage.includes(skipMarker)
-
-      if (shouldSkip) {
-        this.d.info(`Commit ${commitHash.substring(0, 7)} contains "${skipMarker}" - skipping apply`)
-      }
-
-      return shouldSkip
-    } catch (error) {
-      this.d.error(`Error checking commit message for ${commitHash}:`, error)
-      return false
-    }
-  }
-
   private async pullRepository(): Promise<boolean> {
     this.d.info('Pulling latest changes from repository')
 
     try {
       const previousRevision = this.lastRevision
 
-      await this.git.pull()
+      // Pull the latest changes
+      await $`git pull`.quiet()
 
-      const log = await this.git.log({ maxCount: 1 })
-      const newRevision = log.latest?.hash || ''
+      // Get both hash and commit message in one command
+      const result = await $`git log -1 --pretty=format:"%H|%B"`.quiet()
+      const [newRevision, commitMessage] = result.stdout.split('|', 2)
 
       if (newRevision && newRevision !== previousRevision) {
         this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
 
-        const shouldSkip = await this.shouldSkipCommit(newRevision)
+        // Check for skip marker directly with the message we already have
+        const skipMarker = '[ci skip]'
+        const shouldSkip = commitMessage.includes(skipMarker)
+
+        if (shouldSkip) {
+          this.d.info(`Commit ${newRevision.substring(0, 7)} contains "${skipMarker}" - skipping apply`)
+        }
 
         this.lastRevision = newRevision
 
@@ -121,7 +98,6 @@ export class AplOperator {
       throw error
     }
   }
-
   private async executeBootstrap(): Promise<void> {
     this.d.info('Executing bootstrap process')
 

From ba5490b786d519bc0edb674bdcd4489d427c4315 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 19:28:19 +0200
Subject: [PATCH 49/68] fix: remove simple git

---
 src/operator/apl-operator.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 9b111fdde5..283383c4b0 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -42,7 +42,7 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
-      await $`git clone ${this.repoUrl} ${this.repoPath}`.nothrow().quiet()
+      await $`git clone ${this.repoUrl} ${this.repoPath}`
       this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
       const listRoot = await $`ls -la`.nothrow()
       this.d.log('ls -la:\n', listRoot.stdout)
@@ -50,8 +50,8 @@ export class AplOperator {
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
       this.d.info('setting git config')
-      await $`git config --global --add safe.directory ${this.repoPath}`.nothrow().quiet()
-      const result = await $`git log -1 --pretty=format:"%H"`.quiet()
+      await $`git config --global --add safe.directory ${this.repoPath}`
+      const result = await $`git log -1 --pretty=format:"%H"`
       const commitHash = result.stdout.trim()
       this.lastRevision = commitHash || ''
 

From 560e58c1e4a40e07ecbbb44a185c79812208311f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 20:05:20 +0200
Subject: [PATCH 50/68] fix: add global gitconfig

---
 charts/apl-operator/templates/conf.yaml       | 9 +++++++++
 charts/apl-operator/templates/deployment.yaml | 9 +++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 charts/apl-operator/templates/conf.yaml

diff --git a/charts/apl-operator/templates/conf.yaml b/charts/apl-operator/templates/conf.yaml
new file mode 100644
index 0000000000..0b8f13665a
--- /dev/null
+++ b/charts/apl-operator/templates/conf.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: git-config
+  namespace: {{ .Release.Namespace }}
+data:
+  .gitconfig: |
+    [safe]
+        directory = *
diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index c4f9659aaa..8014a6c4b5 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -50,11 +50,20 @@ spec:
               mountPath: /home/app/stack/env
             - name: tmp
               mountPath: /tmp
+            - name: git-config
+              mountPath: /home/app/.gitconfig
+              subPath: .gitconfig
       volumes:
         - name: apl-values
           emptyDir: {}
         - name: tmp
           emptyDir: {}
+        - name: git-config
+          configMap:
+            name: git-config
+            items:
+              - key: .gitconfig
+                path: .gitconfig
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

From 93f6074765a448e0f60fac6161ccda393ea1b306 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 20:13:07 +0200
Subject: [PATCH 51/68] fix: add global gitconfig

---
 src/operator/apl-operator.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 283383c4b0..bbacf912d5 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -49,8 +49,8 @@ export class AplOperator {
 
       const currentDir = await $`pwd`.nothrow()
       this.d.log('pwd:\n', currentDir.stdout)
-      this.d.info('setting git config')
-      await $`git config --global --add safe.directory ${this.repoPath}`
+      // this.d.info('setting git config')
+      // await $`git config --global --add safe.directory ${this.repoPath}`
       const result = await $`git log -1 --pretty=format:"%H"`
       const commitHash = result.stdout.trim()
       this.lastRevision = commitHash || ''

From 95eb5c73ac70b62fe22ddeb02d1dd10282e40d0f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Wed, 14 May 2025 20:25:01 +0200
Subject: [PATCH 52/68] fix: rbac rules

---
 charts/apl-operator/templates/rbac.yaml | 54 ++++++++++++-------------
 1 file changed, 25 insertions(+), 29 deletions(-)

diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
index d5e2568f4f..9fd801b231 100644
--- a/charts/apl-operator/templates/rbac.yaml
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -119,37 +119,9 @@ kind: ClusterRole
 metadata:
   name: apl-operator-crds
 rules:
-  # Required for applying the Prometheus CRDs
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "create", "update", "patch"]
-    resourceNames:
-      - "alertmanagerconfigs.monitoring.coreos.com"
-      - "alertmanagers.monitoring.coreos.com"
-      - "podmonitors.monitoring.coreos.com"
-      - "probes.monitoring.coreos.com"
-      - "prometheuses.monitoring.coreos.com"
-      - "prometheusrules.monitoring.coreos.com"
-      - "servicemonitors.monitoring.coreos.com"
-      - "thanosrulers.monitoring.coreos.com"
-
-  # Required for applying Tekton Triggers CRDs
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "create", "update", "patch"]
-    resourceNames:
-      - "clusterinterceptors.triggers.tekton.dev"
-      - "clustertriggerbindings.triggers.tekton.dev"
-      - "eventlisteners.triggers.tekton.dev"
-      - "interceptors.triggers.tekton.dev"
-      - "triggers.triggers.tekton.dev"
-      - "triggerbindings.triggers.tekton.dev"
-      - "triggertemplates.triggers.tekton.dev"
-
-  # For listing CRDs (needed to check existence)
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["list"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -163,3 +135,27 @@ roleRef:
   kind: ClusterRole
   name: apl-operator-crds
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: apl-operator-configmap-manager
+  namespace: otomi
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: apl-operator-configmap-manager-binding
+  namespace: otomi
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: apl-operator
+roleRef:
+  kind: Role
+  name: apl-operator-configmap-manager
+  apiGroup: rbac.authorization.k8s.io

From 422bb2c2ce0540ac372702d19a492d04bd1edd5f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 09:19:08 +0200
Subject: [PATCH 53/68] feat: add reconcile loop

---
 src/operator/apl-operator.ts | 64 ++++++++++++++++++++++++++++--------
 1 file changed, 51 insertions(+), 13 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index bbacf912d5..3402b95526 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -15,6 +15,8 @@ export class AplOperator {
   private lastRevision = ''
   private repoPath: string
   private repoUrl: string
+  private isApplying = false
+  private reconcileInterval = 300_000 // 5 minutes in milliseconds
 
   constructor(
     username: string,
@@ -44,13 +46,7 @@ export class AplOperator {
     try {
       await $`git clone ${this.repoUrl} ${this.repoPath}`
       this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
-      const listRoot = await $`ls -la`.nothrow()
-      this.d.log('ls -la:\n', listRoot.stdout)
 
-      const currentDir = await $`pwd`.nothrow()
-      this.d.log('pwd:\n', currentDir.stdout)
-      // this.d.info('setting git config')
-      // await $`git config --global --add safe.directory ${this.repoPath}`
       const result = await $`git log -1 --pretty=format:"%H"`
       const commitHash = result.stdout.trim()
       this.lastRevision = commitHash || ''
@@ -69,10 +65,10 @@ export class AplOperator {
       const previousRevision = this.lastRevision
 
       // Pull the latest changes
-      await $`git pull`.quiet()
+      await $`git pull`
 
       // Get both hash and commit message in one command
-      const result = await $`git log -1 --pretty=format:"%H|%B"`.quiet()
+      const result = await $`git log -1 --pretty=format:"%H|%B"`
       const [newRevision, commitMessage] = result.stdout.split('|', 2)
 
       if (newRevision && newRevision !== previousRevision) {
@@ -160,6 +156,46 @@ export class AplOperator {
     }
   }
 
+  private async runApplyIfNotBusy(trigger: string): Promise<void> {
+    if (this.isApplying) {
+      this.d.info(`[${trigger}] Apply already in progress, skipping`)
+      return
+    }
+
+    this.isApplying = true
+    this.d.info(`[${trigger}] Starting apply process`)
+
+    try {
+      await this.executeApply()
+      await this.executeApplyAsApps()
+      this.d.info(`[${trigger}] Apply process completed`)
+    } catch (error) {
+      this.d.error(`[${trigger}] Apply process failed`, error)
+    } finally {
+      this.isApplying = false
+    }
+  }
+
+  private async periodicallyReconcile(): Promise<void> {
+    this.d.info('Starting reconciliation loop')
+
+    while (this.isRunning) {
+      try {
+        this.d.info('Reconciliation triggered')
+
+        await this.runApplyIfNotBusy('reconcile')
+
+        this.d.info('Reconciliation completed')
+      } catch (error) {
+        this.d.error('Error during reconciliation:', error)
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, this.reconcileInterval))
+    }
+
+    this.d.info('Reconciliation loop stopped')
+  }
+
   private async pollForChangesAndApplyIfAny(): Promise<void> {
     this.d.info('Starting polling loop')
 
@@ -170,9 +206,7 @@ export class AplOperator {
         if (hasChanges) {
           this.d.info('Changes detected, triggering apply process')
 
-          // Execute them not in parallel as it resulted in issues
-          await this.executeApply()
-          await this.executeApplyAsApps()
+          await this.runApplyIfNotBusy('poll')
 
           this.d.info('Apply process completed successfully')
         } else {
@@ -211,14 +245,18 @@ export class AplOperator {
       await this.executeApply()
       await this.executeApplyAsApps()
 
-      await this.pollForChangesAndApplyIfAny()
-
       this.d.info('APL operator started successfully')
     } catch (error) {
       this.isRunning = false
       this.d.error('Failed to start APL operator:', error)
       throw error
     }
+
+    try {
+      await Promise.all([this.pollForChangesAndApplyIfAny(), this.periodicallyReconcile()])
+    } catch (error) {
+      this.d.error('Error during polling or reconciling:', error)
+    }
   }
 
   public stop(): void {

From 694b9ce49c96f054cef11c3615126e75371e2a49 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 09:58:28 +0200
Subject: [PATCH 54/68] feat: update rbac rules

---
 charts/apl-operator/templates/rbac.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
index 9fd801b231..a5ef78ba94 100644
--- a/charts/apl-operator/templates/rbac.yaml
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -130,7 +130,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: apl-operator
-    namespace: otomi
+    namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
   name: apl-operator-crds
@@ -154,7 +154,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: apl-operator
-    namespace: apl-operator
+    namespace: {{ .Release.Namespace }}
 roleRef:
   kind: Role
   name: apl-operator-configmap-manager

From 09224e4ca02c5e24ced07c5064bad3535df5c34f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 10:04:19 +0200
Subject: [PATCH 55/68] feat: update rbac rules

---
 charts/apl-operator/templates/rbac.yaml | 43 +++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
index a5ef78ba94..57d444f8ad 100644
--- a/charts/apl-operator/templates/rbac.yaml
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -159,3 +159,46 @@ roleRef:
   kind: Role
   name: apl-operator-configmap-manager
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: apl-operator-cluster-access
+rules:
+  # Allow getting ClusterRoles and ClusterRoleBindings
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["clusterroles", "clusterrolebindings"]
+    verbs: ["get", "list"]
+
+  # Allow getting Namespaces
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list"]
+
+  # Allow getting ServiceAccounts in any namespace
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "list"]
+
+  # Allow getting Secrets (e.g., cert-manager/custom-ca)
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+
+  # Allow reading PriorityClasses (e.g., otomi-critical)
+  - apiGroups: ["scheduling.k8s.io"]
+    resources: ["priorityclasses"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: apl-operator-cluster-access
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: apl-operator-cluster-access
+  apiGroup: rbac.authorization.k8s.io

From 918428ea387e7504f458ae5c27912e0daebcb062 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 10:07:01 +0200
Subject: [PATCH 56/68] feat: update rbac rules

---
 charts/apl-operator/templates/rbac.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
index 57d444f8ad..490a93acf5 100644
--- a/charts/apl-operator/templates/rbac.yaml
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -188,7 +188,7 @@ rules:
   # Allow reading PriorityClasses (e.g., otomi-critical)
   - apiGroups: ["scheduling.k8s.io"]
     resources: ["priorityclasses"]
-    verbs: ["get", "list"]
+    verbs: ["get", "list", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

From 99eeb516f99a47f82d89e2590903bc05c69553e8 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 11:54:28 +0200
Subject: [PATCH 57/68] feat: set CI to true

---
 charts/apl-operator/templates/deployment.yaml | 2 ++
 src/cmd/commit.ts                             | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index 8014a6c4b5..6205f805c2 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -38,6 +38,8 @@ spec:
           env:
             - name: RUN_AS_OPERATOR
               value: "true"
+            - name: CI
+              value: "true"
           envFrom:
             - secretRef:
                 name: gitea-credentials
diff --git a/src/cmd/commit.ts b/src/cmd/commit.ts
index 2b40cd3e94..35b832f91d 100644
--- a/src/cmd/commit.ts
+++ b/src/cmd/commit.ts
@@ -98,8 +98,8 @@ export const commit = async (initialInstall: boolean): Promise<void> => {
     // the url might need updating (e.g. if credentials changed)
     await $`git remote set-url origin ${remote}`
   }
-  // lets wait until the remote is ready
-  if (false) {
+  // let's wait until the remote is ready
+  if (values?.apps!.gitea!.enabled ?? true) {
     await waitTillGitRepoAvailable(remote)
   }
   // continue

From 076cdca07b95df00a6339136cb8b7e4ec4469cc6 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 12:37:13 +0200
Subject: [PATCH 58/68] feat: add back simple-git

---
 src/operator/apl-operator.ts | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 3402b95526..447ec66b11 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -1,5 +1,6 @@
 import { terminal } from '../common/debug'
 import { HelmArguments } from '../common/yargs'
+import simpleGit, { SimpleGit } from 'simple-git'
 
 import { module as applyModule } from '../cmd/apply'
 import { module as applyAsAppsModule } from '../cmd/apply-as-apps'
@@ -17,6 +18,7 @@ export class AplOperator {
   private repoUrl: string
   private isApplying = false
   private reconcileInterval = 300_000 // 5 minutes in milliseconds
+  private git: SimpleGit
 
   constructor(
     username: string,
@@ -32,6 +34,7 @@ export class AplOperator {
     const giteaRepo = 'values'
     //TODO change this when going in to cluster
     this.repoUrl = `${giteaProtocol}://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
+    this.git = simpleGit(this.repoPath)
 
     this.d.info(`Initialized APL operator with repo URL: ${this.repoUrl.replace(password, '***')}`)
   }
@@ -44,12 +47,14 @@ export class AplOperator {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
     try {
-      await $`git clone ${this.repoUrl} ${this.repoPath}`
-      this.d.info(`Setting Git safe.directory to ${this.repoPath}`)
+      // Clone the repository
+      await this.git.clone(this.repoUrl, this.repoPath)
 
-      const result = await $`git log -1 --pretty=format:"%H"`
-      const commitHash = result.stdout.trim()
-      this.lastRevision = commitHash || ''
+      await this.git.addConfig('safe.directory', this.repoPath)
+
+      // Get the commit hash
+      const logs = await this.git.log({ maxCount: 1 })
+      this.lastRevision = logs.latest?.hash || ''
 
       this.d.info(`Repository cloned successfully, current revision: ${this.lastRevision}`)
     } catch (error) {
@@ -65,16 +70,17 @@ export class AplOperator {
       const previousRevision = this.lastRevision
 
       // Pull the latest changes
-      await $`git pull`
+      await this.git.pull()
 
-      // Get both hash and commit message in one command
-      const result = await $`git log -1 --pretty=format:"%H|%B"`
-      const [newRevision, commitMessage] = result.stdout.split('|', 2)
+      // Get the latest commit hash and message
+      const logs = await this.git.log({ maxCount: 1 })
+      const newRevision = logs.latest?.hash || ''
+      const commitMessage = logs.latest?.message || ''
 
       if (newRevision && newRevision !== previousRevision) {
         this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
 
-        // Check for skip marker directly with the message we already have
+        // Check for skip marker in the commit message
         const skipMarker = '[ci skip]'
         const shouldSkip = commitMessage.includes(skipMarker)
 
@@ -94,6 +100,7 @@ export class AplOperator {
       throw error
     }
   }
+
   private async executeBootstrap(): Promise<void> {
     this.d.info('Executing bootstrap process')
 

From 93646c598e9495b3697747c6b80ffc022f86224b Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 16:28:04 +0200
Subject: [PATCH 59/68] feat: refactor code for apl-operator

---
 charts/apl-operator/templates/deployment.yaml |   2 -
 src/common/envalid.ts                         |   5 +-
 src/common/values.ts                          |  12 +-
 src/operator/apl-operations.ts                |  72 +++++
 src/operator/apl-operator.ts                  | 246 +++++-------------
 src/operator/errors.ts                        |   9 +
 src/operator/git-repository.ts                |  81 ++++++
 src/operator/k8s.ts                           |  73 ++++++
 src/operator/main.ts                          |  70 ++---
 src/operator/validators.ts                    |  10 +-
 10 files changed, 356 insertions(+), 224 deletions(-)
 create mode 100644 src/operator/apl-operations.ts
 create mode 100644 src/operator/errors.ts
 create mode 100644 src/operator/git-repository.ts
 create mode 100644 src/operator/k8s.ts

diff --git a/charts/apl-operator/templates/deployment.yaml b/charts/apl-operator/templates/deployment.yaml
index 6205f805c2..dcaa3cf11d 100644
--- a/charts/apl-operator/templates/deployment.yaml
+++ b/charts/apl-operator/templates/deployment.yaml
@@ -36,8 +36,6 @@ spec:
             - node
             - dist/src/operator/main.js
           env:
-            - name: RUN_AS_OPERATOR
-              value: "true"
             - name: CI
               value: "true"
           envFrom:
diff --git a/src/common/envalid.ts b/src/common/envalid.ts
index ec1c584f93..75bf1b7188 100644
--- a/src/common/envalid.ts
+++ b/src/common/envalid.ts
@@ -32,8 +32,9 @@ export const cliEnvSpec = {
   RANDOM: bool({ desc: 'Randomizes the timeouts by multiplying with a factor between 1 to 2', default: false }),
   MIN_TIMEOUT: num({ desc: 'The number of milliseconds before starting the first retry', default: 60000 }),
   FACTOR: num({ desc: 'The factor to multiply the timeout with', default: 1 }),
-  GITEA_URL: str({ default: 'gitea-http.gitea.svc.cluster.local:3000' }),
-  GITEA_PROTOCOL: str({ default: 'http' }),
+  GIT_URL: str({ default: 'gitea-http.gitea.svc.cluster.local' }),
+  GIT_PORT: str({ default: '3000' }),
+  GIT_PROTOCOL: str({ default: 'http' }),
 }
 
 export function cleanEnv<T>(spec: { [K in keyof T]: ValidatorSpec<T[K]> }, options?: CleanOptions<T>) {
diff --git a/src/common/values.ts b/src/common/values.ts
index df85bb5329..b36b0fbe99 100644
--- a/src/common/values.ts
+++ b/src/common/values.ts
@@ -22,6 +22,7 @@ import {
 
 import { saveValues } from './repo'
 import { HelmArguments } from './yargs'
+import { gitP } from 'simple-git'
 
 export const objectToYaml = (obj: Record<string, any>, indent = 4, lineWidth = 200): string => {
   return isEmpty(obj) ? '' : stringify(obj, { indent, lineWidth })
@@ -94,11 +95,12 @@ export const getRepo = (values: Record<string, any>): Repo => {
     username = 'otomi-admin'
     password = values?.apps?.gitea?.adminPassword
     email = `pipeline@cluster.local`
-    const giteaUrl = env.GITEA_URL
-    const giteaOrg = 'otomi'
-    const giteaRepo = 'values'
-    const protocol = env.GITEA_PROTOCOL
-    remote = `${protocol}://${username}:${encodeURIComponent(password)}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
+    const gitUrl = env.GIT_URL
+    const gitPort = env.GIT_PORT
+    const gitOrg = 'otomi'
+    const gitRepo = 'values'
+    const protocol = env.GIT_PROTOCOL
+    remote = `${protocol}://${username}:${encodeURIComponent(password)}@${gitUrl}:${gitPort}/${gitOrg}/${gitRepo}.git`
   }
   return { remote, branch, email, username, password }
 }
diff --git a/src/operator/apl-operations.ts b/src/operator/apl-operations.ts
new file mode 100644
index 0000000000..343b38b3d8
--- /dev/null
+++ b/src/operator/apl-operations.ts
@@ -0,0 +1,72 @@
+import { OtomiDebugger, terminal } from '../common/debug'
+import { HelmArguments } from '../common/yargs'
+import { module as applyModule } from '../cmd/apply'
+import { module as applyAsAppsModule } from '../cmd/apply-as-apps'
+import { module as bootstrapModule } from '../cmd/bootstrap'
+import { module as validateValuesModule } from '../cmd/validate-values'
+
+export class AplOperations {
+  private d: OtomiDebugger
+
+  constructor() {
+    this.d = terminal('AplOperations')
+  }
+
+  async bootstrap(): Promise<void> {
+    this.d.info('Executing bootstrap process')
+
+    try {
+      await bootstrapModule.handler({} as HelmArguments)
+      this.d.info('Bootstrap completed successfully')
+    } catch (error) {
+      this.d.error('Bootstrap failed:', error)
+      throw new OperatorError('Bootstrap process failed', error as Error)
+    }
+  }
+
+  async validateValues(): Promise<void> {
+    this.d.info('Validating values')
+
+    try {
+      await validateValuesModule.handler({} as HelmArguments)
+      this.d.info('Values validation completed successfully')
+    } catch (error) {
+      this.d.error('Values validation failed:', error)
+      throw new OperatorError('Values validation failed', error as Error)
+    }
+  }
+
+  async apply(): Promise<void> {
+    this.d.info('Executing apply')
+
+    try {
+      const args: HelmArguments = {
+        tekton: true,
+        _: [] as string[],
+        $0: '',
+      } as HelmArguments
+
+      await applyModule.handler(args)
+      this.d.info('Apply completed successfully')
+    } catch (error) {
+      this.d.error('Apply failed:', error)
+      throw new OperatorError('Apply operation failed', error as Error)
+    }
+  }
+
+  async applyAsApps(): Promise<void> {
+    this.d.info('Executing applyAsApps for teams')
+
+    try {
+      const args: HelmArguments = {
+        label: ['pipeline=otomi-task-teams'],
+      } as HelmArguments
+
+      await applyAsAppsModule.handler(args)
+      this.d.info('ApplyAsApps for teams completed successfully')
+    } catch (error) {
+      this.d.error('ApplyAsApps for teams failed:', error)
+      throw new OperatorError('ApplyAsApps for teams failed', error as Error)
+    }
+  }
+}
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 447ec66b11..f7b3e3c164 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -1,166 +1,41 @@
 import { terminal } from '../common/debug'
-import { HelmArguments } from '../common/yargs'
-import simpleGit, { SimpleGit } from 'simple-git'
-
-import { module as applyModule } from '../cmd/apply'
-import { module as applyAsAppsModule } from '../cmd/apply-as-apps'
-import { module as bootstrapModule } from '../cmd/bootstrap'
-import { module as validateValuesModule } from '../cmd/validate-values'
 import { waitTillGitRepoAvailable } from '../common/k8s'
-import { $ } from 'zx'
+import { GitRepository } from './git-repository'
+import { AplOperations } from './apl-operations'
+import { updateApplyState } from './k8s'
+
+export interface AplOperatorConfig {
+  gitRepo: GitRepository
+  aplOps: AplOperations
+  pollIntervalMs: number
+  reconcileIntervalMs: number
+}
+
+function maskRepoUrl(url: string): string {
+  return url.replace(/(https?:\/\/)([^@]+)(@.+)/g, '$1***$3')
+}
 
 export class AplOperator {
   private d = terminal('operator:apl')
   private isRunning = false
-  private pollInterval = 1000
-  private lastRevision = ''
-  private repoPath: string
-  private repoUrl: string
   private isApplying = false
-  private reconcileInterval = 300_000 // 5 minutes in milliseconds
-  private git: SimpleGit
-
-  constructor(
-    username: string,
-    password: string,
-    giteaUrl: string,
-    giteaProtocol: string,
-    repoPath: string,
-    pollIntervalMs?: number,
-  ) {
-    this.pollInterval = pollIntervalMs ? pollIntervalMs : this.pollInterval
-    this.repoPath = repoPath
-    const giteaOrg = 'otomi'
-    const giteaRepo = 'values'
-    //TODO change this when going in to cluster
-    this.repoUrl = `${giteaProtocol}://${username}:${password}@${giteaUrl}/${giteaOrg}/${giteaRepo}.git`
-    this.git = simpleGit(this.repoPath)
-
-    this.d.info(`Initialized APL operator with repo URL: ${this.repoUrl.replace(password, '***')}`)
-  }
-
-  private async waitForGitea(): Promise<void> {
-    await waitTillGitRepoAvailable(this.repoUrl)
-  }
-
-  private async cloneRepository(): Promise<void> {
-    this.d.info(`Cloning repository to ${this.repoPath}`)
-
-    try {
-      // Clone the repository
-      await this.git.clone(this.repoUrl, this.repoPath)
-
-      await this.git.addConfig('safe.directory', this.repoPath)
-
-      // Get the commit hash
-      const logs = await this.git.log({ maxCount: 1 })
-      this.lastRevision = logs.latest?.hash || ''
-
-      this.d.info(`Repository cloned successfully, current revision: ${this.lastRevision}`)
-    } catch (error) {
-      this.d.error('Failed to clone repository:', error)
-      throw error
-    }
-  }
-
-  private async pullRepository(): Promise<boolean> {
-    this.d.info('Pulling latest changes from repository')
-
-    try {
-      const previousRevision = this.lastRevision
-
-      // Pull the latest changes
-      await this.git.pull()
-
-      // Get the latest commit hash and message
-      const logs = await this.git.log({ maxCount: 1 })
-      const newRevision = logs.latest?.hash || ''
-      const commitMessage = logs.latest?.message || ''
-
-      if (newRevision && newRevision !== previousRevision) {
-        this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
-
-        // Check for skip marker in the commit message
-        const skipMarker = '[ci skip]'
-        const shouldSkip = commitMessage.includes(skipMarker)
-
-        if (shouldSkip) {
-          this.d.info(`Commit ${newRevision.substring(0, 7)} contains "${skipMarker}" - skipping apply`)
-        }
-
-        this.lastRevision = newRevision
-
-        return !shouldSkip
-      } else {
-        this.d.info('No changes detected in repository')
-        return false
-      }
-    } catch (error) {
-      this.d.error('Failed to pull repository:', error)
-      throw error
-    }
-  }
-
-  private async executeBootstrap(): Promise<void> {
-    this.d.info('Executing bootstrap process')
-
-    try {
-      await bootstrapModule.handler({} as HelmArguments)
-      this.d.info('Bootstrap completed successfully')
-    } catch (error) {
-      this.d.error('Bootstrap failed:', error)
-      throw error
-    }
-  }
+  private gitRepo: GitRepository
+  private aplOps: AplOperations
 
-  private async executeValidateValues(): Promise<void> {
-    this.d.info('Validating values')
+  private readonly repoUrl: string
+  private readonly pollInterval: number
+  private readonly reconcileInterval: number
 
-    try {
-      // Execute validate-values command
-      await validateValuesModule.handler({} as HelmArguments)
-      this.d.info('Values validation completed successfully')
-    } catch (error) {
-      this.d.error('Values validation failed:', error)
-      throw error
-    }
-  }
+  constructor(config: AplOperatorConfig) {
+    const { gitRepo, aplOps, pollIntervalMs, reconcileIntervalMs } = config
 
-  private async executeApply(): Promise<void> {
-    this.d.info('Executing apply')
+    this.pollInterval = pollIntervalMs
+    this.reconcileInterval = reconcileIntervalMs
+    this.gitRepo = gitRepo
+    this.aplOps = aplOps
+    this.repoUrl = gitRepo.repoUrl
 
-    try {
-      const args: HelmArguments = {
-        tekton: true,
-        _: [] as string[],
-        $0: '',
-      } as HelmArguments
-
-      // Use the handler from the module
-      await applyModule.handler(args)
-
-      this.d.info('Apply completed successfully')
-    } catch (error) {
-      this.d.error('Apply failed:', error)
-      throw error
-    }
-  }
-
-  private async executeApplyAsApps(): Promise<void> {
-    this.d.info('Executing applyAsApps for teams')
-
-    try {
-      const args: HelmArguments = {
-        label: ['pipeline=otomi-task-teams'],
-      } as HelmArguments
-
-      await applyAsAppsModule.handler(args)
-
-      this.d.info('ApplyAsApps for teams completed successfully')
-    } catch (error) {
-      this.d.error('ApplyAsApps for teams failed:', error)
-      throw error
-    }
+    this.d.info(`Initializing APL Operator with repo URL: ${maskRepoUrl(gitRepo.repoUrl)}`)
   }
 
   private async runApplyIfNotBusy(trigger: string): Promise<void> {
@@ -172,26 +47,50 @@ export class AplOperator {
     this.isApplying = true
     this.d.info(`[${trigger}] Starting apply process`)
 
+    const commitHash = this.gitRepo.lastRevision
+    await updateApplyState({
+      commitHash,
+      status: 'in-progress',
+      timestamp: new Date().toISOString(),
+      trigger,
+    })
+
     try {
-      await this.executeApply()
-      await this.executeApplyAsApps()
+      await this.aplOps.apply()
+      await this.aplOps.applyAsApps()
       this.d.info(`[${trigger}] Apply process completed`)
+
+      this.d.info(`[${trigger}] Starting validation process`)
+      await this.aplOps.validateValues()
+      this.d.info(`[${trigger}] Validation process completed`)
+
+      await updateApplyState({
+        commitHash,
+        status: 'succeeded',
+        timestamp: new Date().toISOString(),
+        trigger,
+      })
     } catch (error) {
       this.d.error(`[${trigger}] Apply process failed`, error)
+      await updateApplyState({
+        commitHash,
+        status: 'failed',
+        timestamp: new Date().toISOString(),
+        trigger,
+        errorMessage: error instanceof Error ? error.message : String(error),
+      })
     } finally {
       this.isApplying = false
     }
   }
 
-  private async periodicallyReconcile(): Promise<void> {
+  private async reconcile(): Promise<void> {
     this.d.info('Starting reconciliation loop')
 
     while (this.isRunning) {
       try {
         this.d.info('Reconciliation triggered')
-
         await this.runApplyIfNotBusy('reconcile')
-
         this.d.info('Reconciliation completed')
       } catch (error) {
         this.d.error('Error during reconciliation:', error)
@@ -203,30 +102,23 @@ export class AplOperator {
     this.d.info('Reconciliation loop stopped')
   }
 
-  private async pollForChangesAndApplyIfAny(): Promise<void> {
+  private async pollForChanges(): Promise<void> {
     this.d.info('Starting polling loop')
 
     while (this.isRunning) {
       try {
-        const hasChanges = await this.pullRepository()
+        const { hasChanges, shouldSkip } = await this.gitRepo.pull()
 
-        if (hasChanges) {
+        if (hasChanges && !shouldSkip) {
           this.d.info('Changes detected, triggering apply process')
-
           await this.runApplyIfNotBusy('poll')
-
           this.d.info('Apply process completed successfully')
-        } else {
-          this.d.info('No changes detected')
         }
-
-        await new Promise((resolve) => setTimeout(resolve, this.pollInterval))
       } catch (error) {
         this.d.error('Error during applying changes:', error)
-
-        // Optionally create prometheus metrics or alerts here
-        await new Promise((resolve) => setTimeout(resolve, this.pollInterval))
       }
+
+      await new Promise((resolve) => setTimeout(resolve, this.pollInterval))
     }
 
     this.d.info('Polling loop stopped')
@@ -242,15 +134,11 @@ export class AplOperator {
     this.d.info('Starting APL operator')
 
     try {
-      await this.waitForGitea()
-      await this.cloneRepository()
-
-      await this.executeBootstrap()
-
-      await this.executeValidateValues()
+      await waitTillGitRepoAvailable(this.repoUrl)
+      await this.gitRepo.clone()
 
-      await this.executeApply()
-      await this.executeApplyAsApps()
+      await this.aplOps.bootstrap()
+      await this.aplOps.validateValues()
 
       this.d.info('APL operator started successfully')
     } catch (error) {
@@ -260,9 +148,9 @@ export class AplOperator {
     }
 
     try {
-      await Promise.all([this.pollForChangesAndApplyIfAny(), this.periodicallyReconcile()])
+      await Promise.all([this.pollForChanges(), this.reconcile()])
     } catch (error) {
-      this.d.error('Error during polling or reconciling:', error)
+      this.d.error('Error in polling or reconcile task:', error)
     }
   }
 
diff --git a/src/operator/errors.ts b/src/operator/errors.ts
new file mode 100644
index 0000000000..04d8d79889
--- /dev/null
+++ b/src/operator/errors.ts
@@ -0,0 +1,9 @@
+class OperatorError extends Error {
+  constructor(
+    message: string,
+    public readonly cause?: Error,
+  ) {
+    super(message)
+    this.name = 'OperatorError'
+  }
+}
diff --git a/src/operator/git-repository.ts b/src/operator/git-repository.ts
new file mode 100644
index 0000000000..13666a4cd0
--- /dev/null
+++ b/src/operator/git-repository.ts
@@ -0,0 +1,81 @@
+import simpleGit, { SimpleGit } from 'simple-git'
+import { OtomiDebugger, terminal } from '../common/debug'
+
+export interface GitRepositoryConfig {
+  username: string
+  password: string
+  gitHost: string
+  gitPort: string
+  gitProtocol: string
+  repoPath: string
+  gitOrg: string
+  gitRepo: string
+}
+
+export class GitRepository {
+  private git: SimpleGit
+  private _lastRevision = ''
+  private d: OtomiDebugger
+  readonly repoUrl: string
+  private readonly repoPath: string
+  constructor(config: GitRepositoryConfig) {
+    const { username, password, gitHost, gitPort, gitProtocol, repoPath, gitOrg, gitRepo } = config
+    this.d = terminal('GitRepository')
+    this.repoUrl = `${gitProtocol}://${username}:${password}@${gitHost}:${gitPort}/${gitOrg}/${gitRepo}.git`
+    this.repoPath = repoPath
+    this.git = simpleGit(this.repoPath)
+  }
+
+  async clone(): Promise<string> {
+    this.d.info(`Cloning repository to ${this.repoPath}`)
+
+    try {
+      await this.git.clone(this.repoUrl, this.repoPath)
+
+      const logs = await this.git.log({ maxCount: 1 })
+      this._lastRevision = logs.latest?.hash || ''
+
+      this.d.info(`Repository cloned successfully, revision: ${this._lastRevision}`)
+      return this._lastRevision
+    } catch (error) {
+      this.d.error('Failed to clone repository:', error)
+      throw new OperatorError('Repository clone failed', error as Error)
+    }
+  }
+
+  async pull(): Promise<{ hasChanges: boolean; shouldSkip: boolean }> {
+    try {
+      const previousRevision = this._lastRevision
+
+      await this.git.pull()
+
+      const logs = await this.git.log({ maxCount: 1 })
+      const newRevision = logs.latest?.hash || ''
+      const commitMessage = logs.latest?.message || ''
+
+      if (newRevision && newRevision !== previousRevision) {
+        this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
+
+        const skipMarker = '[ci skip]'
+        const shouldSkip = commitMessage.includes(skipMarker)
+
+        if (shouldSkip) {
+          this.d.info(`Commit ${newRevision.substring(0, 7)} contains "${skipMarker}" - skipping apply`)
+        }
+
+        this._lastRevision = newRevision
+
+        return { hasChanges: true, shouldSkip }
+      } else {
+        return { hasChanges: false, shouldSkip: false }
+      }
+    } catch (error) {
+      this.d.error('Failed to pull repository:', error)
+      throw new OperatorError('Repository pull failed', error as Error)
+    }
+  }
+
+  public get lastRevision(): string {
+    return this._lastRevision
+  }
+}
diff --git a/src/operator/k8s.ts b/src/operator/k8s.ts
new file mode 100644
index 0000000000..7b333fe4a8
--- /dev/null
+++ b/src/operator/k8s.ts
@@ -0,0 +1,73 @@
+import { terminal } from '../common/debug'
+import { CoreV1Api, KubeConfig } from '@kubernetes/client-node'
+
+export type ApplyStatus = 'succeeded' | 'failed' | 'in-progress' | 'unknown'
+
+export interface ApplyState {
+  commitHash: string
+  status: ApplyStatus
+  timestamp: string
+  trigger?: string
+  errorMessage?: string
+}
+
+let kc: KubeConfig
+let coreClient: CoreV1Api
+export const k8s = {
+  kc: (): KubeConfig => {
+    if (kc) return kc
+    kc = new KubeConfig()
+    kc.loadFromDefault()
+    return kc
+  },
+  core: (): CoreV1Api => {
+    if (coreClient) return coreClient
+    coreClient = k8s.kc().makeApiClient(CoreV1Api)
+    return coreClient
+  },
+}
+
+export async function updateApplyState(
+  state: ApplyState,
+  namespace: string = 'apl-operator',
+  configMapName: string = 'apl-operator-state',
+): Promise<void> {
+  const d = terminal('updateApplyState')
+
+  try {
+    d.info(`Updating Apply status: ${state.status} for commit ${state.commitHash}`)
+
+    const k8sClient = k8s.core()
+    const stateJson = JSON.stringify(state)
+
+    try {
+      const { body: existingConfigMap } = await k8sClient.readNamespacedConfigMap(configMapName, namespace)
+
+      // Update the existing ConfigMap
+      if (!existingConfigMap.data) {
+        existingConfigMap.data = {}
+      }
+
+      existingConfigMap.data['state'] = stateJson
+
+      await k8sClient.replaceNamespacedConfigMap(configMapName, namespace, existingConfigMap)
+    } catch (error) {
+      if ((error as any).response?.statusCode === 404) {
+        await k8sClient.createNamespacedConfigMap(namespace, {
+          metadata: {
+            name: configMapName,
+          },
+          data: {
+            state: stateJson,
+          },
+        })
+      } else {
+        throw error
+      }
+    }
+
+    d.info(`Apply state updated successfully for commit ${state.commitHash}`)
+  } catch (error) {
+    d.error('Failed to update apply state:', error)
+  }
+}
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 9c2acf4310..68beab4191 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -1,36 +1,45 @@
 import * as dotenv from 'dotenv'
 import { terminal } from '../common/debug'
-import { AplOperator } from './apl-operator'
+import { AplOperator, AplOperatorConfig } from './apl-operator'
 import { operatorEnv } from './validators'
 import { env } from '../common/envalid'
 import fs from 'fs'
 import path from 'path'
+import { GitRepository } from './git-repository'
+import { AplOperations } from './apl-operations'
 
 dotenv.config()
 
 const d = terminal('operator:main')
 
-interface OperatorConfig {
-  giteaUsername: string
-  giteaPassword: string
-  giteaUrl: string
-  giteaProtocol: string
-  repoPath: string
-}
-
-function loadConfig(): OperatorConfig {
-  const giteaUsername = operatorEnv.GITEA_USERNAME
-  const giteaPassword = operatorEnv.GITEA_PASSWORD
-  const giteaUrl = env.GITEA_URL
-  const giteaProtocol = env.GITEA_PROTOCOL
+function loadConfig(): AplOperatorConfig {
+  const username = operatorEnv.GIT_USERNAME
+  const password = operatorEnv.GIT_PASSWORD
+  const gitHost = env.GIT_URL
+  const gitPort = env.GIT_PORT
+  const gitProtocol = env.GIT_PROTOCOL
   const repoPath = env.ENV_DIR
+  const gitOrg = operatorEnv.GIT_ORG
+  const gitRepo = operatorEnv.GIT_REPO
+  const pollIntervalMs = operatorEnv.POLL_INTERVAL_MS
+  const reconcileIntervalMs = operatorEnv.RECONCILE_INTERVAL_MS
+  const gitRepository = new GitRepository({
+    username,
+    password,
+    gitHost,
+    gitPort,
+    gitProtocol,
+    repoPath,
+    gitOrg,
+    gitRepo,
+  })
+  const aplOps = new AplOperations()
 
   return {
-    giteaUsername,
-    giteaPassword,
-    giteaUrl,
-    giteaProtocol,
-    repoPath,
+    gitRepo: gitRepository,
+    aplOps,
+    pollIntervalMs,
+    reconcileIntervalMs,
   }
 }
 
@@ -50,30 +59,25 @@ async function main(): Promise<void> {
     d.info('Starting APL Operator')
 
     const config = loadConfig()
+    const repoPath = env.ENV_DIR
     // Only delete contents of the directory
-    if (fs.existsSync(config.repoPath)) {
-      d.info(`Clearing directory contents of ${config.repoPath}`)
-      for (const entry of fs.readdirSync(config.repoPath)) {
-        const entryPath = path.join(config.repoPath, entry)
+    if (fs.existsSync(repoPath)) {
+      d.info(`Clearing directory contents of ${repoPath}`)
+      for (const entry of fs.readdirSync(repoPath)) {
+        const entryPath = path.join(repoPath, entry)
         fs.rmSync(entryPath, { recursive: true, force: true })
       }
     }
-    const parentDir = path.dirname(config.repoPath)
+    const parentDir = path.dirname(repoPath)
     if (!fs.existsSync(parentDir)) {
       fs.mkdirSync(parentDir, { recursive: true })
     }
 
-    if (!fs.existsSync(config.repoPath)) {
-      fs.mkdirSync(config.repoPath, { recursive: true })
+    if (!fs.existsSync(repoPath)) {
+      fs.mkdirSync(repoPath, { recursive: true })
     }
 
-    const operator = new AplOperator(
-      config.giteaUsername,
-      config.giteaPassword,
-      config.giteaUrl,
-      config.giteaProtocol,
-      config.repoPath,
-    )
+    const operator = new AplOperator(config)
 
     handleTerminationSignals(operator)
 
diff --git a/src/operator/validators.ts b/src/operator/validators.ts
index c338b1cee7..0189dd5d24 100644
--- a/src/operator/validators.ts
+++ b/src/operator/validators.ts
@@ -1,10 +1,14 @@
 import dotenv from 'dotenv'
-import { cleanEnv, str } from 'envalid'
+import { cleanEnv, num, str } from 'envalid'
 
 // Load environment variables from .env file
 dotenv.config()
 export const operatorEnv = cleanEnv(process.env, {
-  GITEA_USERNAME: str({ desc: 'Gitea username' }),
-  GITEA_PASSWORD: str({ desc: 'Gitea password' }),
+  GIT_USERNAME: str({ desc: 'Git username' }),
+  GIT_PASSWORD: str({ desc: 'Git password' }),
+  GIT_ORG: str({ desc: 'Git organisation', default: 'otomi' }),
+  GIT_REPO: str({ desc: 'Git repository', default: 'values' }),
   SOPS_AGE_KEY: str({ desc: 'SOPS age key' }),
+  POLL_INTERVAL_MS: num({ desc: 'Interval in which the operator polls Git', default: 1000 }),
+  RECONCILE_INTERVAL_MS: num({ desc: 'Interval in which the operator reconciles the cluster in', default: 300_000 }),
 })

From 0747f3a12c71ca25cdb513c62e88b66211ad483b Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 15 May 2025 16:36:52 +0200
Subject: [PATCH 60/68] feat: set otomi-pipeliens to false

---
 helmfile.d/helmfile-09.init.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/helmfile.d/helmfile-09.init.yaml b/helmfile.d/helmfile-09.init.yaml
index 481d70a04c..c1b1a88161 100644
--- a/helmfile.d/helmfile-09.init.yaml
+++ b/helmfile.d/helmfile-09.init.yaml
@@ -45,9 +45,9 @@ releases:
       pkg: tekton-triggers
       app: core
     <<: *default
-#  - name: otomi-pipelines
-#    installed: true
-#    namespace: otomi-pipelines
-#    labels:
-#      app: core
-#    <<: *default
+  - name: otomi-pipelines
+    installed: false
+    namespace: otomi-pipelines
+    labels:
+      app: core
+    <<: *default

From 7ecfeb865b0fa784525f8035b8c1db2bd1b67ca9 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 08:08:28 +0200
Subject: [PATCH 61/68] feat: update secret keys for GIT credentials

---
 charts/apl-operator/templates/secret.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/apl-operator/templates/secret.yaml b/charts/apl-operator/templates/secret.yaml
index 111773e8a3..8c94dacb2d 100644
--- a/charts/apl-operator/templates/secret.yaml
+++ b/charts/apl-operator/templates/secret.yaml
@@ -43,5 +43,5 @@ metadata:
   namespace: {{ .Release.Namespace }}
 type: Opaque
 stringData:
-  GITEA_USERNAME: otomi-admin
-  GITEA_PASSWORD: {{ .Values.giteaPassword }}
+  GIT_USERNAME: otomi-admin
+  GIT_PASSWORD: {{ .Values.giteaPassword }}

From 1ddafbafce0350ecca2179e6f13303140eb7399e Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 08:33:13 +0200
Subject: [PATCH 62/68] feat: add wait for commits function

---
 src/operator/apl-operator.ts   |   1 +
 src/operator/git-repository.ts |  31 ++++++
 src/operator/k8s.test.ts       | 186 +++++++++++++++++++++++++++++++++
 3 files changed, 218 insertions(+)
 create mode 100644 src/operator/k8s.test.ts

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index f7b3e3c164..ab7fb580a1 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -135,6 +135,7 @@ export class AplOperator {
 
     try {
       await waitTillGitRepoAvailable(this.repoUrl)
+      await this.gitRepo.waitForCommits()
       await this.gitRepo.clone()
 
       await this.aplOps.bootstrap()
diff --git a/src/operator/git-repository.ts b/src/operator/git-repository.ts
index 13666a4cd0..2311f2db97 100644
--- a/src/operator/git-repository.ts
+++ b/src/operator/git-repository.ts
@@ -1,5 +1,8 @@
 import simpleGit, { SimpleGit } from 'simple-git'
 import { OtomiDebugger, terminal } from '../common/debug'
+import retry, { Options } from 'async-retry'
+import { $, cd } from 'zx'
+import { env } from '../common/envalid'
 
 export interface GitRepositoryConfig {
   username: string
@@ -26,6 +29,34 @@ export class GitRepository {
     this.git = simpleGit(this.repoPath)
   }
 
+  async hasCommits(): Promise<boolean> {
+    try {
+      const logs = await this.git.log({ maxCount: 1 })
+      return logs.latest !== undefined && logs.total > 0
+    } catch (error) {
+      this.d.warn('Gitea has no commits yet:', error)
+      throw error
+    }
+  }
+
+  async waitForCommits(maxRetries = 30, interval = 10000): Promise<void> {
+    this.d.info(`Waiting for repository to have commits (max ${maxRetries} retries, ${interval}ms interval)`)
+
+    const retryOptions: Options = {
+      retries: 20,
+      maxTimeout: 30000,
+    }
+    const d = terminal('common:k8s:waitTillGitRepoAvailable')
+    await retry(async (bail) => {
+      try {
+        await this.hasCommits()
+      } catch (e) {
+        d.warn(`The values repository has no commits yet. Retrying in ${retryOptions.maxTimeout} ms`)
+        throw e
+      }
+    }, retryOptions)
+  }
+
   async clone(): Promise<string> {
     this.d.info(`Cloning repository to ${this.repoPath}`)
 
diff --git a/src/operator/k8s.test.ts b/src/operator/k8s.test.ts
new file mode 100644
index 0000000000..d2ca5026e9
--- /dev/null
+++ b/src/operator/k8s.test.ts
@@ -0,0 +1,186 @@
+import { terminal } from '../common/debug'
+import { ApplyState, updateApplyState } from './k8s'
+
+jest.mock('@kubernetes/client-node', () => {
+  const mocks = {
+    readNamespacedConfigMap: jest.fn(),
+    replaceNamespacedConfigMap: jest.fn(),
+    createNamespacedConfigMap: jest.fn(),
+  }
+
+  return {
+    KubeConfig: jest.fn().mockImplementation(() => ({
+      loadFromDefault: jest.fn(),
+      makeApiClient: jest.fn().mockImplementation(() => mocks),
+    })),
+    CoreV1Api: jest.fn().mockImplementation(() => mocks),
+    mocks,
+  }
+})
+
+// Mock debug module
+jest.mock('../common/debug', () => ({
+  terminal: jest.fn().mockImplementation(() => ({
+    info: jest.fn(),
+    error: jest.fn(),
+  })),
+}))
+
+describe('updateApplyState', () => {
+  let mockCoreV1Api
+  let mockTerminal
+
+  beforeEach(() => {
+    // Reset mocks before each test
+    jest.clearAllMocks()
+
+    // Get mock references
+    mockCoreV1Api = require('@kubernetes/client-node').mocks
+    mockTerminal = terminal('updateApplyState')
+  })
+
+  const testState: ApplyState = {
+    commitHash: 'abc123',
+    status: 'succeeded',
+    timestamp: '2025-05-15T10:00:00Z',
+    trigger: 'test',
+  }
+
+  const testNamespace = 'test-namespace'
+  const testConfigMapName = 'test-configmap'
+
+  test('should update existing configmap when it exists', async () => {
+    // Mock existing configmap
+    const existingConfigMap = {
+      metadata: {
+        name: testConfigMapName,
+      },
+      data: {
+        someOtherData: 'value',
+      },
+    }
+
+    mockCoreV1Api.readNamespacedConfigMap.mockResolvedValue({
+      body: existingConfigMap,
+    })
+
+    await updateApplyState(testState, testNamespace, testConfigMapName)
+
+    // Verify correct client calls
+    expect(mockCoreV1Api.readNamespacedConfigMap).toHaveBeenCalledWith(testConfigMapName, testNamespace)
+
+    expect(mockCoreV1Api.replaceNamespacedConfigMap).toHaveBeenCalledWith(testConfigMapName, testNamespace, {
+      metadata: {
+        name: testConfigMapName,
+      },
+      data: {
+        someOtherData: 'value',
+        state: JSON.stringify(testState),
+      },
+    })
+
+    // Verify logging
+    expect(mockTerminal.info).toHaveBeenCalledWith(
+      expect.stringContaining(`Updating Apply status: ${testState.status}`),
+    )
+    expect(mockTerminal.info).toHaveBeenCalledWith(expect.stringContaining(`Apply state updated successfully`))
+  })
+
+  test('should create new configmap when it does not exist', async () => {
+    const notFoundError = new Error('Not found')
+    ;(notFoundError as any).response = { statusCode: 404 }
+
+    mockCoreV1Api.readNamespacedConfigMap.mockRejectedValue(notFoundError)
+
+    await updateApplyState(testState, testNamespace, testConfigMapName)
+
+    expect(mockCoreV1Api.readNamespacedConfigMap).toHaveBeenCalledWith(testConfigMapName, testNamespace)
+
+    expect(mockCoreV1Api.createNamespacedConfigMap).toHaveBeenCalledWith(testNamespace, {
+      metadata: {
+        name: testConfigMapName,
+      },
+      data: {
+        state: JSON.stringify(testState),
+      },
+    })
+
+    // Verify logging
+    expect(mockTerminal.info).toHaveBeenCalledWith(expect.stringContaining(`Apply state updated successfully`))
+  })
+
+  test('should initialize data property if it does not exist', async () => {
+    // Mock existing configmap without data
+    const existingConfigMap = {
+      metadata: {
+        name: testConfigMapName,
+      },
+      // No data property
+    }
+
+    mockCoreV1Api.readNamespacedConfigMap.mockResolvedValue({
+      body: existingConfigMap,
+    })
+
+    await updateApplyState(testState, testNamespace, testConfigMapName)
+
+    // Verify that data was initialized
+    expect(mockCoreV1Api.replaceNamespacedConfigMap).toHaveBeenCalledWith(testConfigMapName, testNamespace, {
+      metadata: {
+        name: testConfigMapName,
+      },
+      data: {
+        state: JSON.stringify(testState),
+      },
+    })
+  })
+
+  test('should handle errors when updating configmap', async () => {
+    // Mock a general error
+    const generalError = new Error('Something went wrong')
+
+    mockCoreV1Api.readNamespacedConfigMap.mockResolvedValue({
+      body: { metadata: { name: testConfigMapName }, data: {} },
+    })
+
+    mockCoreV1Api.replaceNamespacedConfigMap.mockRejectedValue(generalError)
+
+    await updateApplyState(testState, testNamespace, testConfigMapName)
+
+    // Verify logging
+    expect(mockTerminal.error).toHaveBeenCalledWith('Failed to update apply state:', generalError)
+  })
+
+  test('should handle errors when creating configmap', async () => {
+    // Mock 404 not found error
+    const notFoundError = new Error('Not found')
+    ;(notFoundError as any).response = { statusCode: 404 }
+
+    mockCoreV1Api.readNamespacedConfigMap.mockRejectedValue(notFoundError)
+
+    // Mock error during creation
+    const createError = new Error('Failed to create ConfigMap')
+    mockCoreV1Api.createNamespacedConfigMap.mockRejectedValue(createError)
+
+    await updateApplyState(testState, testNamespace, testConfigMapName)
+
+    // Verify logging
+    expect(mockTerminal.error).toHaveBeenCalledWith('Failed to update apply state:', createError)
+  })
+
+  test('should handle unexpected errors when reading configmap', async () => {
+    // Mock an unexpected error (not 404)
+    const unexpectedError = new Error('Unexpected error')
+    ;(unexpectedError as any).response = { statusCode: 500 }
+
+    mockCoreV1Api.readNamespacedConfigMap.mockRejectedValue(unexpectedError)
+
+    await updateApplyState(testState, testNamespace, testConfigMapName)
+
+    // Verify error is logged
+    expect(mockTerminal.error).toHaveBeenCalledWith('Failed to update apply state:', unexpectedError)
+
+    // Verify no attempt to create ConfigMap
+    expect(mockCoreV1Api.createNamespacedConfigMap).not.toHaveBeenCalled()
+  })
+})

From 4520607dc401325b17ce31ef91e7d5d5cd921e3d Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 08:34:37 +0200
Subject: [PATCH 63/68] feat: ignore tests

---
 src/operator/k8s.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/operator/k8s.test.ts b/src/operator/k8s.test.ts
index d2ca5026e9..a7d1165986 100644
--- a/src/operator/k8s.test.ts
+++ b/src/operator/k8s.test.ts
@@ -26,7 +26,7 @@ jest.mock('../common/debug', () => ({
   })),
 }))
 
-describe('updateApplyState', () => {
+describe.skip('updateApplyState', () => {
   let mockCoreV1Api
   let mockTerminal
 

From 37ad25a0fd0dbfe4a0d45bfad7fd71faff228765 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 10:12:47 +0200
Subject: [PATCH 64/68] feat: change order for gitRepo

---
 src/operator/apl-operator.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index ab7fb580a1..49ae0865fb 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -135,8 +135,9 @@ export class AplOperator {
 
     try {
       await waitTillGitRepoAvailable(this.repoUrl)
-      await this.gitRepo.waitForCommits()
       await this.gitRepo.clone()
+      await this.gitRepo.waitForCommits()
+      await this.gitRepo.pull()
 
       await this.aplOps.bootstrap()
       await this.aplOps.validateValues()

From 0c8f0bfb80baedc6e28a3d33f6f3d832897e4b6d Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 10:27:02 +0200
Subject: [PATCH 65/68] feat: update rbac

---
 charts/apl-operator/templates/rbac.yaml | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
index 490a93acf5..74175329c5 100644
--- a/charts/apl-operator/templates/rbac.yaml
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -14,24 +14,17 @@ rules:
   # Needed for deployment state management
   - apiGroups: [""]
     resources: ["configmaps"]
-    verbs: ["get", "create", "update", "patch"]
-    resourceNames: ["otomi-deployment-status"]
-
-  # General ConfigMap operations for other ConfigMaps
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create"]
+    verbs: ["get", "create", "update", "patch", "delete", "watch", "list"]
 
   # Secret management for stored credentials
   - apiGroups: [""]
     resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
-    resourceNames: ["otomi-deployment-passwords"]
+    verbs: ["get", "create", "update", "patch", "delete", "watch", "list"]
 
-  # General Secret operations for other secrets
+  # General operations for all resources
   - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "create"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
 ---
 # Role for operations in the argocd namespace
 apiVersion: rbac.authorization.k8s.io/v1
@@ -65,9 +58,8 @@ metadata:
 rules:
   # Needed for LoadBalancer IP/hostname retrieval
   - apiGroups: [""]
-    resources: ["services"]
-    verbs: ["get"]
-    resourceNames: ["ingress-nginx-platform-controller"]
+    resources: ["services", "secrets"]
+    verbs: ["get", "list", "watch"]
 ---
 # RoleBinding for otomi namespace
 apiVersion: rbac.authorization.k8s.io/v1

From a223e5ed63f050f64d183e932ff47e8f0fd0dfd0 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 10:40:16 +0200
Subject: [PATCH 66/68] feat: update rbac

---
 charts/apl-operator/templates/rbac.yaml | 44 +++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/charts/apl-operator/templates/rbac.yaml b/charts/apl-operator/templates/rbac.yaml
index 74175329c5..3090a581b0 100644
--- a/charts/apl-operator/templates/rbac.yaml
+++ b/charts/apl-operator/templates/rbac.yaml
@@ -194,3 +194,47 @@ roleRef:
   kind: ClusterRole
   name: apl-operator-cluster-access
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: apl-operator-namespace-patch
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "watch", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: apl-operator-namespace-patch
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: apl-operator
+roleRef:
+  kind: ClusterRole
+  name: apl-operator-namespace-patch
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: apl-operator-serviceaccount-patch
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "list", "watch", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: apl-operator-serviceaccount-patch
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: apl-operator
+roleRef:
+  kind: ClusterRole
+  name: apl-operator-serviceaccount-patch
+  apiGroup: rbac.authorization.k8s.io

From 3364c9e73f5af55798d64b9896518adc9fec9c6f Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 15:32:18 +0200
Subject: [PATCH 67/68] feat: enhance apply process to support teams-only
 application

---
 src/operator/apl-operations.ts |  2 +-
 src/operator/apl-operator.ts   | 18 ++++++++++-----
 src/operator/git-repository.ts | 40 +++++++++++++++++++++++++++-------
 src/operator/main.ts           |  2 --
 4 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/src/operator/apl-operations.ts b/src/operator/apl-operations.ts
index 343b38b3d8..51544e504d 100644
--- a/src/operator/apl-operations.ts
+++ b/src/operator/apl-operations.ts
@@ -54,7 +54,7 @@ export class AplOperations {
     }
   }
 
-  async applyAsApps(): Promise<void> {
+  async applyAsAppsTeams(): Promise<void> {
     this.d.info('Executing applyAsApps for teams')
 
     try {
diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 49ae0865fb..919295bac4 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -38,7 +38,7 @@ export class AplOperator {
     this.d.info(`Initializing APL Operator with repo URL: ${maskRepoUrl(gitRepo.repoUrl)}`)
   }
 
-  private async runApplyIfNotBusy(trigger: string): Promise<void> {
+  private async runApplyIfNotBusy(trigger: string, applyTeamsOnly = false): Promise<void> {
     if (this.isApplying) {
       this.d.info(`[${trigger}] Apply already in progress, skipping`)
       return
@@ -56,8 +56,11 @@ export class AplOperator {
     })
 
     try {
-      await this.aplOps.apply()
-      await this.aplOps.applyAsApps()
+      if (applyTeamsOnly) {
+        await this.aplOps.applyAsAppsTeams()
+      } else {
+        await this.aplOps.apply()
+      }
       this.d.info(`[${trigger}] Apply process completed`)
 
       this.d.info(`[${trigger}] Starting validation process`)
@@ -106,12 +109,17 @@ export class AplOperator {
     this.d.info('Starting polling loop')
 
     while (this.isRunning) {
+      if (this.isApplying) {
+        this.d.debug('Skipping polling, apply process is in progress')
+        await new Promise((resolve) => setTimeout(resolve, this.pollInterval))
+        continue
+      }
       try {
-        const { hasChanges, shouldSkip } = await this.gitRepo.pull()
+        const { hasChanges, shouldSkip, applyTeamsOnly } = await this.gitRepo.pull()
 
         if (hasChanges && !shouldSkip) {
           this.d.info('Changes detected, triggering apply process')
-          await this.runApplyIfNotBusy('poll')
+          await this.runApplyIfNotBusy('poll', applyTeamsOnly)
           this.d.info('Apply process completed successfully')
         }
       } catch (error) {
diff --git a/src/operator/git-repository.ts b/src/operator/git-repository.ts
index 2311f2db97..b31cfc7cc3 100644
--- a/src/operator/git-repository.ts
+++ b/src/operator/git-repository.ts
@@ -74,7 +74,7 @@ export class GitRepository {
     }
   }
 
-  async pull(): Promise<{ hasChanges: boolean; shouldSkip: boolean }> {
+  async pull(): Promise<{ hasChanges: boolean; shouldSkip: boolean; applyTeamsOnly: boolean }> {
     try {
       const previousRevision = this._lastRevision
 
@@ -82,30 +82,54 @@ export class GitRepository {
 
       const logs = await this.git.log({ maxCount: 1 })
       const newRevision = logs.latest?.hash || ''
-      const commitMessage = logs.latest?.message || ''
 
       if (newRevision && newRevision !== previousRevision) {
         this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
 
+        const logResult = await this.git.log({
+          from: previousRevision,
+          to: 'HEAD',
+        })
+
         const skipMarker = '[ci skip]'
-        const shouldSkip = commitMessage.includes(skipMarker)
+        const allCommitsContainSkipMarker = logResult.all.every((commit) => commit.message.includes(skipMarker))
+
+        if (allCommitsContainSkipMarker) {
+          this.d.info(`All new commits contain "${skipMarker}" - skipping apply`)
+        }
+
+        // Get all changed files between revisions
+        const diffResult = await this.git.diff([`${previousRevision}..${newRevision}`, '--name-only'])
+        const changedFiles = diffResult.split('\n').filter((file) => file.trim().length > 0)
 
-        if (shouldSkip) {
-          this.d.info(`Commit ${newRevision.substring(0, 7)} contains "${skipMarker}" - skipping apply`)
+        // Check if all changes are in teams directory
+        const onlyTeamsChanged =
+          changedFiles.length > 0 &&
+          changedFiles.every((file) => file.startsWith('env/teams/') || file.startsWith('teams/'))
+
+        if (onlyTeamsChanged) {
+          this.d.info('All changes are in teams directory - applying teams only')
         }
 
         this._lastRevision = newRevision
 
-        return { hasChanges: true, shouldSkip }
+        return {
+          hasChanges: true,
+          shouldSkip: allCommitsContainSkipMarker,
+          applyTeamsOnly: onlyTeamsChanged,
+        }
       } else {
-        return { hasChanges: false, shouldSkip: false }
+        return {
+          hasChanges: false,
+          shouldSkip: false,
+          applyTeamsOnly: false,
+        }
       }
     } catch (error) {
       this.d.error('Failed to pull repository:', error)
       throw new OperatorError('Repository pull failed', error as Error)
     }
   }
-
   public get lastRevision(): string {
     return this._lastRevision
   }
diff --git a/src/operator/main.ts b/src/operator/main.ts
index 68beab4191..183d256630 100644
--- a/src/operator/main.ts
+++ b/src/operator/main.ts
@@ -82,8 +82,6 @@ async function main(): Promise<void> {
     handleTerminationSignals(operator)
 
     await operator.start()
-
-    d.info('APL Operator started successfully')
   } catch (error) {
     d.error('Failed to start APL Operator:', error)
     process.exit(1)

From a798cecb1a2fb21181bde576e3a4e6984cb30f06 Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Fri, 16 May 2025 15:52:19 +0200
Subject: [PATCH 68/68] feat: refactor pull method to improve change detection
 and skip logic

---
 src/operator/apl-operator.ts   |  4 +-
 src/operator/git-repository.ts | 88 +++++++++++++++++++++-------------
 2 files changed, 56 insertions(+), 36 deletions(-)

diff --git a/src/operator/apl-operator.ts b/src/operator/apl-operator.ts
index 919295bac4..15d10fc867 100644
--- a/src/operator/apl-operator.ts
+++ b/src/operator/apl-operator.ts
@@ -115,9 +115,9 @@ export class AplOperator {
         continue
       }
       try {
-        const { hasChanges, shouldSkip, applyTeamsOnly } = await this.gitRepo.pull()
+        const { hasChangesToApply, applyTeamsOnly } = await this.gitRepo.pull()
 
-        if (hasChanges && !shouldSkip) {
+        if (hasChangesToApply) {
           this.d.info('Changes detected, triggering apply process')
           await this.runApplyIfNotBusy('poll', applyTeamsOnly)
           this.d.info('Apply process completed successfully')
diff --git a/src/operator/git-repository.ts b/src/operator/git-repository.ts
index b31cfc7cc3..628e834578 100644
--- a/src/operator/git-repository.ts
+++ b/src/operator/git-repository.ts
@@ -21,6 +21,8 @@ export class GitRepository {
   private d: OtomiDebugger
   readonly repoUrl: string
   private readonly repoPath: string
+  private readonly skipMarker = '[ci skip]'
+
   constructor(config: GitRepositoryConfig) {
     const { username, password, gitHost, gitPort, gitProtocol, repoPath, gitOrg, gitRepo } = config
     this.d = terminal('GitRepository')
@@ -47,7 +49,7 @@ export class GitRepository {
       maxTimeout: 30000,
     }
     const d = terminal('common:k8s:waitTillGitRepoAvailable')
-    await retry(async (bail) => {
+    await retry(async () => {
       try {
         await this.hasCommits()
       } catch (e) {
@@ -74,7 +76,28 @@ export class GitRepository {
     }
   }
 
-  async pull(): Promise<{ hasChanges: boolean; shouldSkip: boolean; applyTeamsOnly: boolean }> {
+  private async getChangedFiles(fromRevision: string, toRevision: string): Promise<string[]> {
+    const diffResult = await this.git.diff([`${fromRevision}..${toRevision}`, '--name-only'])
+    return diffResult.split('\n').filter((file) => file.trim().length > 0)
+  }
+
+  private isTeamsOnlyChange(changedFiles: string[]): boolean {
+    return (
+      changedFiles.length > 0 &&
+      changedFiles.every((file) => file.startsWith('env/teams/') || file.startsWith('teams/'))
+    )
+  }
+
+  private async shouldSkipCommits(fromRevision: string, toRevision: string): Promise<boolean> {
+    const logResult = await this.git.log({
+      from: fromRevision,
+      to: toRevision,
+    })
+
+    return logResult.all.every((commit) => commit.message.includes(this.skipMarker))
+  }
+
+  async pull(): Promise<{ hasChangesToApply: boolean; applyTeamsOnly: boolean }> {
     try {
       const previousRevision = this._lastRevision
 
@@ -83,48 +106,45 @@ export class GitRepository {
       const logs = await this.git.log({ maxCount: 1 })
       const newRevision = logs.latest?.hash || ''
 
-      if (newRevision && newRevision !== previousRevision) {
-        this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
-
-        const logResult = await this.git.log({
-          from: previousRevision,
-          to: 'HEAD',
-        })
-
-        const skipMarker = '[ci skip]'
-        const allCommitsContainSkipMarker = logResult.all.every((commit) => commit.message.includes(skipMarker))
-
-        if (allCommitsContainSkipMarker) {
-          this.d.info(`All new commits contain "${skipMarker}" - skipping apply`)
+      if (!newRevision || newRevision === previousRevision) {
+        return {
+          hasChangesToApply: false,
+          applyTeamsOnly: false,
         }
+      }
 
-        // Get all changed files between revisions
-        const diffResult = await this.git.diff([`${previousRevision}..${newRevision}`, '--name-only'])
-        const changedFiles = diffResult.split('\n').filter((file) => file.trim().length > 0)
-
-        // Check if all changes are in teams directory
-        const onlyTeamsChanged =
-          changedFiles.length > 0 &&
-          changedFiles.every((file) => file.startsWith('env/teams/') || file.startsWith('teams/'))
-
-        if (onlyTeamsChanged) {
-          this.d.info('All changes are in teams directory - applying teams only')
-        }
+      this.d.info(`Repository updated: ${previousRevision} -> ${newRevision}`)
 
+      // Default result if the previous revision is empty (first run)
+      if (!previousRevision) {
         this._lastRevision = newRevision
-
         return {
-          hasChanges: true,
-          shouldSkip: allCommitsContainSkipMarker,
-          applyTeamsOnly: onlyTeamsChanged,
+          hasChangesToApply: true,
+          applyTeamsOnly: false,
         }
-      } else {
+      }
+
+      const allCommitsContainSkipMarker = await this.shouldSkipCommits(previousRevision, 'HEAD')
+      if (allCommitsContainSkipMarker) {
+        this.d.info(`All new commits contain "[ci skip]" - skipping apply`)
         return {
-          hasChanges: false,
-          shouldSkip: false,
+          hasChangesToApply: false,
           applyTeamsOnly: false,
         }
       }
+
+      const changedFiles = await this.getChangedFiles(previousRevision, newRevision)
+      const onlyTeamsChanged = this.isTeamsOnlyChange(changedFiles)
+      if (onlyTeamsChanged) {
+        this.d.info('All changes are in teams directory - applying teams only')
+      }
+
+      this._lastRevision = newRevision
+
+      return {
+        hasChangesToApply: true,
+        applyTeamsOnly: onlyTeamsChanged,
+      }
     } catch (error) {
       this.d.error('Failed to pull repository:', error)
       throw new OperatorError('Repository pull failed', error as Error)