feat: Secret module works with infisical and local file storage backends

feat: WIP add secrets module and macro crate
chore: cleanup unused imports
2025-08-19 11:59:21 -04:00 · 2025-08-15 14:40:39 -04:00 · 2025-08-14 16:44:22 -04:00 · 2025-08-14 20:42:09 +00:00 · 2025-08-14 20:36:19 +00:00 · 2025-08-11 19:49:06 -04:00
139 changed files with 5014 additions and 1254 deletions
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -9,7 +9,7 @@ jobs:
  check:
    runs-on: docker
    container:
-      image: hub.nationtech.io/harmony/harmony_composer:latest@sha256:eb0406fcb95c63df9b7c4b19bc50ad7914dd8232ce98e9c9abef628e07c69386
+      image: hub.nationtech.io/harmony/harmony_composer:latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
--- a/.gitea/workflows/harmony_composer.yaml
+++ b/.gitea/workflows/harmony_composer.yaml
@@ -7,7 +7,7 @@ on:
 jobs:
  package_harmony_composer:
    container:
-      image: hub.nationtech.io/harmony/harmony_composer:latest@sha256:eb0406fcb95c63df9b7c4b19bc50ad7914dd8232ce98e9c9abef628e07c69386
+      image: hub.nationtech.io/harmony/harmony_composer:latest
    runs-on: dind
    steps:
      - name: Checkout code
@@ -45,14 +45,14 @@ jobs:
            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/tags/snapshot-latest" \
            | jq -r '.id // empty')
-          
+
          if [ -n "$RELEASE_ID" ]; then
            # Delete existing release
            curl -X DELETE \
              -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
              "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/$RELEASE_ID"
          fi
-          
+
          # Create new release
          RESPONSE=$(curl -X POST \
            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
@@ -65,7 +65,7 @@ jobs:
              "prerelease": true
            }' \
            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases")
-          
+
          echo "RELEASE_ID=$(echo $RESPONSE | jq -r '.id')" >> $GITHUB_ENV

      - name: Upload Linux binary
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,25 @@
-target
-private_repos
-log/
-*.tgz
-.gitignore
+### General ###
+private_repos/
+
+### Harmony ###
+harmony.log
+
+### Helm ###
+# Chart dependencies
+**/charts/*.tgz
+
+### Rust ###
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+
+# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
+# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
+Cargo.lock
+
+# These are backup files generated by rustfmt
+**/*.rs.bk
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -96,6 +96,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "ansi_term"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b3568b48b7cefa6b8ce125f9bb4989e52fbcc29ebea88df04cc7c5f12f70455"
+
 [[package]]
 name = "anstream"
 version = "0.6.19"
@@ -219,15 +225,6 @@ dependencies = [
 "syn",
 ]

-[[package]]
-name = "atomic"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
-dependencies = [
- "bytemuck",
-]
-
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -381,7 +378,7 @@ dependencies = [
 "serde_json",
 "serde_repr",
 "serde_urlencoded",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "tokio",
 "tokio-util",
 "tower-service",
@@ -418,12 +415,6 @@ version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"

-[[package]]
-name = "bytemuck"
-version = "1.23.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c76a5792e44e4abe34d3abf15636779261d45a7450612059293d1d2cfc63422"
-
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -482,7 +473,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]

 [[package]]
@@ -524,6 +515,12 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"

+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
 [[package]]
 name = "chacha20"
 version = "0.9.1"
@@ -665,6 +662,19 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "console"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e09ced7ebbccb63b4c65413d821f2e00ce54c5ca4514ddc6b3c892fdbcbc69d"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "once_cell",
+ "unicode-width 0.2.0",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -1152,6 +1162,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1255,6 +1271,18 @@ dependencies = [
 name = "example"
 version = "0.0.0"

+[[package]]
+name = "example-application-monitoring-with-tenant"
+version = "0.1.0"
+dependencies = [
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "logging",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "example-cli"
 version = "0.1.0"
@@ -1358,7 +1386,6 @@ dependencies = [
 "cidr",
 "env_logger",
 "harmony",
- "harmony_cli",
 "harmony_macros",
 "harmony_tui",
 "harmony_types",
@@ -1444,19 +1471,6 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"

-[[package]]
-name = "figment"
-version = "0.10.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
-dependencies = [
- "atomic",
- "pear",
- "serde",
- "uncased",
- "version_check",
-]
-
 [[package]]
 name = "filetime"
 version = "0.2.25"
@@ -1681,9 +1695,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi",
 "wasi 0.14.2+wasi-0.2.4",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -1779,22 +1795,23 @@ dependencies = [
 "dyn-clone",
 "email_address",
 "env_logger",
- "figment",
 "fqdn",
 "futures-util",
+ "harmony-secret-derive",
 "harmony_macros",
 "harmony_types",
 "helm-wrapper-rs",
 "hex",
 "http 1.3.1",
- "inquire",
 "k3d-rs",
 "k8s-openapi",
 "kube",
+ "kube-derive",
 "lazy_static",
 "libredfish",
 "log",
 "non-blank-string-rs",
+ "once_cell",
 "opnsense-config",
 "opnsense-config-xml",
 "pretty_assertions",
@@ -1802,6 +1819,7 @@ dependencies = [
 "reqwest 0.11.27",
 "russh",
 "rust-ipmi",
+ "schemars 0.8.22",
 "semver",
 "serde",
 "serde-value",
@@ -1820,16 +1838,50 @@ dependencies = [
 "uuid",
 ]

+[[package]]
+name = "harmony-secret"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "directories",
+ "harmony-secret-derive",
+ "http 1.3.1",
+ "infisical",
+ "lazy_static",
+ "log",
+ "pretty_assertions",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.14",
+ "tokio",
+]
+
+[[package]]
+name = "harmony-secret-derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "harmony_cli"
 version = "0.1.0"
 dependencies = [
 "assert_cmd",
 "clap",
+ "console",
 "env_logger",
 "harmony",
 "harmony_tui",
+ "indicatif",
+ "indicatif-log-bridge",
 "inquire",
+ "lazy_static",
+ "log",
 "tokio",
 ]

@@ -1840,10 +1892,16 @@ dependencies = [
 "bollard",
 "cargo_metadata",
 "clap",
+ "console",
 "current_platform",
 "env_logger",
 "futures-util",
+ "harmony_cli",
+ "indicatif",
+ "indicatif-log-bridge",
+ "lazy_static",
 "log",
+ "once_cell",
 "serde_json",
 "tokio",
 ]
@@ -1942,7 +2000,7 @@ dependencies = [
 "non-blank-string-rs",
 "serde",
 "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]

 [[package]]
@@ -2110,7 +2168,7 @@ dependencies = [
 "httpdate",
 "itoa",
 "pin-project-lite",
- "socket2",
+ "socket2 0.5.10",
 "tokio",
 "tower-service",
 "tracing",
@@ -2189,6 +2247,7 @@ dependencies = [
 "tokio",
 "tokio-rustls",
 "tower-service",
+ "webpki-roots",
 ]

 [[package]]
@@ -2251,7 +2310,7 @@ dependencies = [
 "libc",
 "percent-encoding",
 "pin-project-lite",
- "socket2",
+ "socket2 0.5.10",
 "system-configuration 0.6.1",
 "tokio",
 "tower-service",
@@ -2439,6 +2498,29 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "indicatif"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70a646d946d06bedbbc4cac4c218acf4bbf2d87757a784857025f4d447e4e1cd"
+dependencies = [
+ "console",
+ "portable-atomic",
+ "unicode-width 0.2.0",
+ "unit-prefix",
+ "web-time",
+]
+
+[[package]]
+name = "indicatif-log-bridge"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63703cf9069b85dbe6fe26e1c5230d013dee99d3559cd3d02ba39e099ef7ab02"
+dependencies = [
+ "indicatif",
+ "log",
+]
+
 [[package]]
 name = "indoc"
 version = "2.0.6"
@@ -2446,10 +2528,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"

 [[package]]
-name = "inlinable_string"
-version = "0.1.15"
+name = "infisical"
+version = "0.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8fae54786f62fb2918dcfae3d568594e50eb9b5c25bf04371af6fe7516452fb"
+checksum = "4d97c33b08e22b2f7b9f87a8fc06a7d247442db7bf216ffc6661a74ed8aea658"
+dependencies = [
+ "base64 0.22.1",
+ "reqwest 0.12.20",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "tokio",
+ "url",
+]

 [[package]]
 name = "inout"
@@ -2491,6 +2582,17 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "io-uring"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d93587f37623a1a17d94ef2bc9ada592f5465fe7732084ab7beefabe5c77c0c4"
+dependencies = [
+ "bitflags 2.9.1",
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.11.0"
@@ -2584,7 +2686,7 @@ dependencies = [
 "pest_derive",
 "regex",
 "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]

 [[package]]
@@ -2652,6 +2754,7 @@ dependencies = [
 "k8s-openapi",
 "kube-client",
 "kube-core",
+ "kube-derive",
 "kube-runtime",
 ]

@@ -2684,7 +2787,7 @@ dependencies = [
 "serde",
 "serde_json",
 "serde_yaml",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "tokio",
 "tokio-tungstenite",
 "tokio-util",
@@ -2705,10 +2808,25 @@ dependencies = [
 "http 1.3.1",
 "json-patch",
 "k8s-openapi",
+ "schemars 0.8.22",
 "serde",
 "serde-value",
 "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
+]
+
+[[package]]
+name = "kube-derive"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "079fc8c1c397538628309cfdee20696ebdcc26745f9fb17f89b78782205bd995"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "syn",
 ]

 [[package]]
@@ -2732,7 +2850,7 @@ dependencies = [
 "pin-project",
 "serde",
 "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "tokio",
 "tokio-util",
 "tracing",
@@ -2826,6 +2944,15 @@ dependencies = [
 "log",
 ]

+[[package]]
+name = "logging"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "461a8beca676e8ab1bd468c92e9b4436d6368e11e96ae038209e520cfe665e46"
+dependencies = [
+ "ansi_term",
+]
+
 [[package]]
 name = "lru"
 version = "0.12.5"
@@ -2835,6 +2962,12 @@ dependencies = [
 "hashbrown 0.15.4",
 ]

+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "md5"
 version = "0.7.0"
@@ -3137,7 +3270,7 @@ dependencies = [
 "pretty_assertions",
 "rand 0.8.5",
 "serde",
- "thiserror 1.0.69",
+ "thiserror 2.0.14",
 "tokio",
 "uuid",
 "xml-rs",
@@ -3272,29 +3405,6 @@ dependencies = [
 "hmac",
 ]

-[[package]]
-name = "pear"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdeeaa00ce488657faba8ebf44ab9361f9365a97bd39ffb8a60663f57ff4b467"
-dependencies = [
- "inlinable_string",
- "pear_codegen",
- "yansi",
-]
-
-[[package]]
-name = "pear_codegen"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bab5b985dc082b345f812b7df84e1bef27e7207b39e448439ba8bd69c93f147"
-dependencies = [
- "proc-macro2",
- "proc-macro2-diagnostics",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "pem"
 version = "3.0.5"
@@ -3327,7 +3437,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323"
 dependencies = [
 "memchr",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "ucd-trie",
 ]

@@ -3548,6 +3658,15 @@ dependencies = [
 "elliptic-curve",
 ]

+[[package]]
+name = "proc-macro-crate"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
+dependencies = [
+ "toml_edit",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@@ -3557,25 +3676,67 @@ dependencies = [
 "unicode-ident",
 ]

-[[package]]
-name = "proc-macro2-diagnostics"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "version_check",
- "yansi",
-]
-
 [[package]]
 name = "punycode"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9e1dcb320d6839f6edb64f7a4a59d39b30480d4d1765b56873f7c858538a5fe"

+[[package]]
+name = "quinn"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2 0.5.10",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.3",
+ "lru-slab",
+ "rand 0.9.1",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.14",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.5.10",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -3694,7 +3855,7 @@ checksum = "dd6f9d3d47bdd2ad6945c5015a226ec6155d0bcdfd8f7cd29f86b71f8de99d2b"
 dependencies = [
 "getrandom 0.2.16",
 "libredox",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]

 [[package]]
@@ -3795,6 +3956,7 @@ dependencies = [
 "base64 0.22.1",
 "bytes",
 "encoding_rs",
+ "futures-channel",
 "futures-core",
 "futures-util",
 "h2 0.4.10",
@@ -3811,6 +3973,8 @@ dependencies = [
 "native-tls",
 "percent-encoding",
 "pin-project-lite",
+ "quinn",
+ "rustls",
 "rustls-pki-types",
 "serde",
 "serde_json",
@@ -3818,6 +3982,7 @@ dependencies = [
 "sync_wrapper 1.0.2",
 "tokio",
 "tokio-native-tls",
+ "tokio-rustls",
 "tokio-util",
 "tower",
 "tower-http",
@@ -3827,6 +3992,7 @@ dependencies = [
 "wasm-bindgen-futures",
 "wasm-streams",
 "web-sys",
+ "webpki-roots",
 ]

 [[package]]
@@ -3990,7 +4156,7 @@ dependencies = [
 "flurry",
 "log",
 "serde",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "tokio",
 "tokio-util",
 ]
@@ -4016,6 +4182,12 @@ version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"

+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -4115,6 +4287,7 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
+ "web-time",
 "zeroize",
 ]

@@ -4159,6 +4332,18 @@ dependencies = [
 "windows-sys 0.59.0",
 ]

+[[package]]
+name = "schemars"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
+dependencies = [
+ "dyn-clone",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "schemars"
 version = "0.9.0"
@@ -4173,9 +4358,9 @@ dependencies = [

 [[package]]
 name = "schemars"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1375ba8ef45a6f15d83fa8748f1079428295d403d6ea991d09ab100155fbc06d"
+checksum = "82d20c4491bc164fa2f6c5d44565947a52ad80b9505d8e36f8d54c27c739fcd0"
 dependencies = [
 "dyn-clone",
 "ref-cast",
@@ -4183,6 +4368,18 @@ dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "schemars_derive"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -4315,6 +4512,17 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.140"
@@ -4393,7 +4601,7 @@ dependencies = [
 "indexmap 1.9.3",
 "indexmap 2.10.0",
 "schemars 0.9.0",
- "schemars 1.0.3",
+ "schemars 1.0.4",
 "serde",
 "serde_derive",
 "serde_json",
@@ -4518,7 +4726,7 @@ checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb"
 dependencies = [
 "num-bigint",
 "num-traits",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "time",
 ]

@@ -4565,6 +4773,16 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "socket2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -4702,9 +4920,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "syn"
-version = "2.0.104"
+version = "2.0.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+checksum = "7bc3fcb250e53458e712715cf74285c1f889686520d79294a9ef3bd7aa1fc619"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4838,11 +5056,11 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "0b0949c3a6c842cbde3f1686d6eea5a010516deb7085f79db747562d4102f41e"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.14",
 ]

 [[package]]
@@ -4858,9 +5076,9 @@ dependencies = [

 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "cc5b44b4ab9c2fdd0e0512e6bece8388e214c0749f5862b114cc5b7a25daf227"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4927,20 +5145,38 @@ dependencies = [
 ]

 [[package]]
-name = "tokio"
-version = "1.45.1"
+name = "tinyvec"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
+checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.47.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
 "backtrace",
 "bytes",
+ "io-uring",
 "libc",
 "mio 1.0.4",
+ "parking_lot",
 "pin-project-lite",
 "signal-hook-registry",
- "socket2",
+ "slab",
+ "socket2 0.6.0",
 "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -5190,7 +5426,7 @@ dependencies = [
 "log",
 "rand 0.9.1",
 "sha1",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 "utf-8",
 ]

@@ -5212,15 +5448,6 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"

-[[package]]
-name = "uncased"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
-dependencies = [
- "version_check",
-]
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.18"
@@ -5262,6 +5489,12 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"

+[[package]]
+name = "unit-prefix"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "323402cff2dd658f39ca17c789b502021b3f18707c91cdf22e3838e1b4023817"
+
 [[package]]
 name = "universal-hash"
 version = "0.5.1"
@@ -5494,6 +5727,15 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "webpki-roots"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,8 @@ members = [
  "harmony_cli",
  "k3d",
  "harmony_composer",
+  "harmony_secret_derive",
+  "harmony_secret",
 ]

 [workspace.package]
@@ -53,7 +55,10 @@ chrono = "0.4"
 similar = "2"
 uuid = { version = "1.11", features = ["v4", "fast-rng", "macro-diagnostics"] }
 pretty_assertions = "1.4.1"
+tempfile = "3.20.0"
 bollard = "0.19.1"
 base64 = "0.22.1"
 tar = "0.4.44"
-figment = { version = "0.10.19", features = ["env"] }
+lazy_static = "1.5.0"
+directories = "6.0.0"
+thiserror = "2.0.14"
--- a/3
+++ b/3
@@ -13,6 +13,7 @@ WORKDIR /app
 RUN rustup target add x86_64-pc-windows-gnu
 RUN rustup target add x86_64-unknown-linux-gnu
 RUN rustup component add rustfmt
+RUN rustup component add clippy

 RUN apt update

@@ -22,4 +23,4 @@ RUN apt install -y nodejs docker.io mingw-w64

 COPY --from=build /app/target/release/harmony_composer .

-ENTRYPOINT ["/app/harmony_composer"]
+ENTRYPOINT ["/app/harmony_composer"]
--- a/README.md
+++ b/README.md
@@ -1,5 +1,6 @@
-# Harmony : Open-source infrastructure orchestration that treats your platform like first-class code.
-*By [NationTech](https://nationtech.io)*
+# Harmony : Open-source infrastructure orchestration that treats your platform like first-class code
+
+_By [NationTech](https://nationtech.io)_

 [![Build](https://git.nationtech.io/NationTech/harmony/actions/workflows/check.yml/badge.svg)](https://git.nationtech.io/nationtech/harmony)
 [![License](https://img.shields.io/badge/license-AGPLv3-blue?style=flat-square)](LICENSE)
@@ -23,11 +24,11 @@ From a **developer laptop** to a **global production cluster**, a single **sourc

 Infrastructure is essential, but it shouldn’t be your core business. Harmony is built on three guiding principles that make modern platforms reliable, repeatable, and easy to reason about.

-| Principle | What it means for you |
-|-----------|-----------------------|
-| **Infrastructure as Resilient Code** | Replace sprawling YAML and bash scripts with type-safe Rust. Test, refactor, and version your platform just like application code. |
-| **Prove It Works — Before You Deploy** | Harmony uses the compiler to verify that your application’s needs match the target environment’s capabilities at **compile-time**, eliminating an entire class of runtime outages. |
-| **One Unified Model** | Software and infrastructure are a single system. Harmony models them together, enabling deep automation—from bare-metal servers to Kubernetes workloads—with zero context switching. |
+| Principle                              | What it means for you                                                                                                                                                                |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Infrastructure as Resilient Code**   | Replace sprawling YAML and bash scripts with type-safe Rust. Test, refactor, and version your platform just like application code.                                                   |
+| **Prove It Works — Before You Deploy** | Harmony uses the compiler to verify that your application’s needs match the target environment’s capabilities at **compile-time**, eliminating an entire class of runtime outages.   |
+| **One Unified Model**                  | Software and infrastructure are a single system. Harmony models them together, enabling deep automation—from bare-metal servers to Kubernetes workloads—with zero context switching. |

 These principles surface as simple, ergonomic Rust APIs that let teams focus on their product while trusting the platform underneath.

@@ -63,22 +64,20 @@ async fn main() {
        },
    };

-    // 2. Pick where it should run
-    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
-        Inventory::autoload(),                // auto-detect hardware / kube-config
-        K8sAnywhereTopology::from_env(),      // local k3d, CI, staging, prod…
-    )
-    .await
-    .unwrap();
-
-    // 3. Enhance with extra scores (monitoring, CI/CD, …)
+    // 2. Enhance with extra scores (monitoring, CI/CD, …)
    let mut monitoring = MonitoringAlertingStackScore::new();
    monitoring.namespace = Some(lamp_stack.config.namespace.clone());

-    maestro.register_all(vec![Box::new(lamp_stack), Box::new(monitoring)]);
-
-    // 4. Launch an interactive CLI / TUI
-    harmony_cli::init(maestro, None).await.unwrap();
+    // 3. Run your scores on the desired topology & inventory
+    harmony_cli::run(
+        Inventory::autoload(),                // auto-detect hardware / kube-config
+        K8sAnywhereTopology::from_env(),      // local k3d, CI, staging, prod…
+        vec![
+          Box::new(lamp_stack),
+          Box::new(monitoring)
+        ],
+        None
+    ).await.unwrap();
 }
 ```

@@ -94,13 +93,13 @@ Harmony analyses the code, shows an execution plan in a TUI, and applies it once

 ## 3 · Core Concepts

-| Term | One-liner |
-|------|-----------|
-| **Score<T>** | Declarative description of the desired state (e.g., `LAMPScore`). |
-| **Interpret<T>** | Imperative logic that realises a `Score` on a specific environment. |
-| **Topology** | An environment (local k3d, AWS, bare-metal) exposing verified *Capabilities* (Kubernetes, DNS, …). |
-| **Maestro** | Orchestrator that compiles Scores + Topology, ensuring all capabilities line up **at compile-time**. |
-| **Inventory** | Optional catalogue of physical assets for bare-metal and edge deployments. |
+| Term             | One-liner                                                                                            |
+| ---------------- | ---------------------------------------------------------------------------------------------------- |
+| **Score<T>**     | Declarative description of the desired state (e.g., `LAMPScore`).                                    |
+| **Interpret<T>** | Imperative logic that realises a `Score` on a specific environment.                                  |
+| **Topology**     | An environment (local k3d, AWS, bare-metal) exposing verified _Capabilities_ (Kubernetes, DNS, …).   |
+| **Maestro**      | Orchestrator that compiles Scores + Topology, ensuring all capabilities line up **at compile-time**. |
+| **Inventory**    | Optional catalogue of physical assets for bare-metal and edge deployments.                           |

 A visual overview is in the diagram below.

@@ -112,9 +111,9 @@ A visual overview is in the diagram below.

 Prerequisites:

-* Rust 
-* Docker (if you deploy locally)
-* `kubectl` / `helm` for Kubernetes-based topologies
+- Rust
+- Docker (if you deploy locally)
+- `kubectl` / `helm` for Kubernetes-based topologies

 ```bash
 git clone https://git.nationtech.io/nationtech/harmony
@@ -126,15 +125,15 @@ cargo build --release          # builds the CLI, TUI and libraries

 ## 5 · Learning More

-* **Architectural Decision Records** – dive into the rationale  
-  - [ADR-001 · Why Rust](adr/001-rust.md)  
-  - [ADR-003 · Infrastructure Abstractions](adr/003-infrastructure-abstractions.md)  
-  - [ADR-006 · Secret Management](adr/006-secret-management.md)  
+- **Architectural Decision Records** – dive into the rationale
+  - [ADR-001 · Why Rust](adr/001-rust.md)
+  - [ADR-003 · Infrastructure Abstractions](adr/003-infrastructure-abstractions.md)
+  - [ADR-006 · Secret Management](adr/006-secret-management.md)
  - [ADR-011 · Multi-Tenant Cluster](adr/011-multi-tenant-cluster.md)

-* **Extending Harmony** – write new Scores / Interprets, add hardware like OPNsense firewalls, or embed Harmony in your own tooling (`/docs`).
+- **Extending Harmony** – write new Scores / Interprets, add hardware like OPNsense firewalls, or embed Harmony in your own tooling (`/docs`).

-* **Community** – discussions and roadmap live in [GitLab issues](https://git.nationtech.io/nationtech/harmony/-/issues). PRs, ideas, and feedback are welcome!
+- **Community** – discussions and roadmap live in [GitLab issues](https://git.nationtech.io/nationtech/harmony/-/issues). PRs, ideas, and feedback are welcome!

 ---

@@ -148,4 +147,4 @@ See [LICENSE](LICENSE) for the full text.

 ---

-*Made with ❤️ & 🦀 by the NationTech and the Harmony community*
+_Made with ❤️ & 🦀 by the NationTech and the Harmony community_
--- a/check.sh
+++ b/check.sh
@@ -1,5 +1,7 @@
 #!/bin/sh
 set -e
+
 cargo check --all-targets --all-features --keep-going
 cargo fmt --check
+cargo clippy
 cargo test
--- a/examples/application_monitoring_with_tenant/Cargo.toml
+++ b/examples/application_monitoring_with_tenant/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "example-application-monitoring-with-tenant"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+env_logger.workspace = true
+harmony = { version = "0.1.0", path = "../../harmony" }
+harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
+logging = "0.1.0"
+tokio.workspace = true
+url.workspace = true
--- a/examples/application_monitoring_with_tenant/src/main.rs
+++ b/examples/application_monitoring_with_tenant/src/main.rs
@@ -0,0 +1,55 @@
+use std::{path::PathBuf, str::FromStr, sync::Arc};
+
+use harmony::{
+    data::Id,
+    inventory::Inventory,
+    modules::{
+        application::{ApplicationScore, RustWebFramework, RustWebapp, features::Monitoring},
+        monitoring::alert_channel::webhook_receiver::WebhookReceiver,
+        tenant::TenantScore,
+    },
+    topology::{K8sAnywhereTopology, Url, tenant::TenantConfig},
+};
+
+#[tokio::main]
+async fn main() {
+    //TODO there is a bug where the application is deployed into the namespace matching the
+    //application name and the tenant is created in the namesapce matching the tenant name
+    //in order for the application to be deployed in the tenant namespace the application.name and
+    //the TenantConfig.name must match
+    let tenant = TenantScore {
+        config: TenantConfig {
+            id: Id::from_str("test-tenant-id").unwrap(),
+            name: "example-monitoring".to_string(),
+            ..Default::default()
+        },
+    };
+    let application = Arc::new(RustWebapp {
+        name: "example-monitoring".to_string(),
+        domain: Url::Url(url::Url::parse("https://rustapp.harmony.example.com").unwrap()),
+        project_root: PathBuf::from("./examples/rust/webapp"),
+        framework: Some(RustWebFramework::Leptos),
+    });
+
+    let webhook_receiver = WebhookReceiver {
+        name: "sample-webhook-receiver".to_string(),
+        url: Url::Url(url::Url::parse("https://webhook-doesnt-exist.com").unwrap()),
+    };
+
+    let app = ApplicationScore {
+        features: vec![Box::new(Monitoring {
+            alert_receiver: vec![Box::new(webhook_receiver)],
+            application: application.clone(),
+        })],
+        application,
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(tenant), Box::new(app)],
+        None,
+    )
+    .await
+    .unwrap();
+}
--- a/examples/cli/src/main.rs
+++ b/examples/cli/src/main.rs
@@ -1,20 +1,21 @@
 use harmony::{
    inventory::Inventory,
-    maestro::Maestro,
    modules::dummy::{ErrorScore, PanicScore, SuccessScore},
    topology::LocalhostTopology,
 };

 #[tokio::main]
 async fn main() {
-    let inventory = Inventory::autoload();
-    let topology = LocalhostTopology::new();
-    let mut maestro = Maestro::initialize(inventory, topology).await.unwrap();
-
-    maestro.register_all(vec![
-        Box::new(SuccessScore {}),
-        Box::new(ErrorScore {}),
-        Box::new(PanicScore {}),
-    ]);
-    harmony_cli::init(maestro, None).await.unwrap();
+    harmony_cli::run(
+        Inventory::autoload(),
+        LocalhostTopology::new(),
+        vec![
+            Box::new(SuccessScore {}),
+            Box::new(ErrorScore {}),
+            Box::new(PanicScore {}),
+        ],
+        None,
+    )
+    .await
+    .unwrap();
 }
--- a/examples/kube-rs/src/main.rs
+++ b/examples/kube-rs/src/main.rs
@@ -125,40 +125,47 @@ spec:
                  name: nginx"#,
    )
    .unwrap();
-    return deployment;
+    deployment
 }
 fn nginx_deployment_2() -> Deployment {
-    let mut pod_template = PodTemplateSpec::default();
-    pod_template.metadata = Some(ObjectMeta {
-        labels: Some(BTreeMap::from([(
-            "app".to_string(),
-            "nginx-test".to_string(),
-        )])),
-        ..Default::default()
-    });
-    pod_template.spec = Some(PodSpec {
-        containers: vec![Container {
-            name: "nginx".to_string(),
-            image: Some("nginx".to_string()),
+    let pod_template = PodTemplateSpec {
+        metadata: Some(ObjectMeta {
+            labels: Some(BTreeMap::from([(
+                "app".to_string(),
+                "nginx-test".to_string(),
+            )])),
            ..Default::default()
-        }],
-        ..Default::default()
-    });
-    let mut spec = DeploymentSpec::default();
-    spec.template = pod_template;
-    spec.selector = LabelSelector {
-        match_expressions: None,
-        match_labels: Some(BTreeMap::from([(
-            "app".to_string(),
-            "nginx-test".to_string(),
-        )])),
+        }),
+        spec: Some(PodSpec {
+            containers: vec![Container {
+                name: "nginx".to_string(),
+                image: Some("nginx".to_string()),
+                ..Default::default()
+            }],
+            ..Default::default()
+        }),
    };

-    let mut deployment = Deployment::default();
-    deployment.spec = Some(spec);
-    deployment.metadata.name = Some("nginx-test".to_string());
+    let spec = DeploymentSpec {
+        template: pod_template,
+        selector: LabelSelector {
+            match_expressions: None,
+            match_labels: Some(BTreeMap::from([(
+                "app".to_string(),
+                "nginx-test".to_string(),
+            )])),
+        },
+        ..Default::default()
+    };

-    deployment
+    Deployment {
+        spec: Some(spec),
+        metadata: ObjectMeta {
+            name: Some("nginx-test".to_string()),
+            ..Default::default()
+        },
+        ..Default::default()
+    }
 }

 fn nginx_deployment() -> Deployment {
--- a/examples/lamp/src/main.rs
+++ b/examples/lamp/src/main.rs
@@ -1,7 +1,6 @@
 use harmony::{
    data::Version,
    inventory::Inventory,
-    maestro::Maestro,
    modules::lamp::{LAMPConfig, LAMPScore},
    topology::{K8sAnywhereTopology, Url},
 };
@@ -24,7 +23,7 @@ async fn main() {
        // This config can be extended as needed for more complicated configurations
        config: LAMPConfig {
            project_root: "./php".into(),
-            database_size: format!("4Gi").into(),
+            database_size: "4Gi".to_string().into(),
            ..Default::default()
        },
    };
@@ -43,15 +42,13 @@ async fn main() {
    // K8sAnywhereTopology as it is the most automatic one that enables you to easily deploy
    // locally, to development environment from a CI, to staging, and to production with settings
    // that automatically adapt to each environment grade.
-    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
+    harmony_cli::run(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
+        vec![Box::new(lamp_stack)],
+        None,
    )
    .await
    .unwrap();
-
-    maestro.register_all(vec![Box::new(lamp_stack)]);
-    // Here we bootstrap the CLI, this gives some nice features if you need them
-    harmony_cli::init(maestro, None).await.unwrap();
 }
 // That's it, end of the infra as code.
--- a/examples/monitoring/src/main.rs
+++ b/examples/monitoring/src/main.rs
@@ -2,7 +2,6 @@ use std::collections::HashMap;

 use harmony::{
    inventory::Inventory,
-    maestro::Maestro,
    modules::{
        monitoring::{
            alert_channel::discord_alert_channel::DiscordWebhook,
@@ -51,8 +50,8 @@ async fn main() {

    let service_monitor_endpoint = ServiceMonitorEndpoint {
        port: Some("80".to_string()),
-        path: "/metrics".to_string(),
-        scheme: HTTPScheme::HTTP,
+        path: Some("/metrics".to_string()),
+        scheme: Some(HTTPScheme::HTTP),
        ..Default::default()
    };

@@ -74,13 +73,13 @@ async fn main() {
        rules: vec![Box::new(additional_rules), Box::new(additional_rules2)],
        service_monitors: vec![service_monitor],
    };
-    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
+
+    harmony_cli::run(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
+        vec![Box::new(alerting_score)],
+        None,
    )
    .await
    .unwrap();
-
-    maestro.register_all(vec![Box::new(alerting_score)]);
-    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/monitoring_with_tenant/src/main.rs
+++ b/examples/monitoring_with_tenant/src/main.rs
@@ -1,9 +1,8 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, str::FromStr};

 use harmony::{
    data::Id,
    inventory::Inventory,
-    maestro::Maestro,
    modules::{
        monitoring::{
            alert_channel::discord_alert_channel::DiscordWebhook,
@@ -29,7 +28,7 @@ use harmony::{
 async fn main() {
    let tenant = TenantScore {
        config: TenantConfig {
-            id: Id::from_string("1234".to_string()),
+            id: Id::from_str("1234").unwrap(),
            name: "test-tenant".to_string(),
            resource_limits: ResourceLimits {
                cpu_request_cores: 6.0,
@@ -54,8 +53,8 @@ async fn main() {

    let service_monitor_endpoint = ServiceMonitorEndpoint {
        port: Some("80".to_string()),
-        path: "/metrics".to_string(),
-        scheme: HTTPScheme::HTTP,
+        path: Some("/metrics".to_string()),
+        scheme: Some(HTTPScheme::HTTP),
        ..Default::default()
    };

@@ -78,13 +77,13 @@ async fn main() {
        rules: vec![Box::new(additional_rules)],
        service_monitors: vec![service_monitor],
    };
-    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
+
+    harmony_cli::run(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
+        vec![Box::new(tenant), Box::new(alerting_score)],
+        None,
    )
    .await
    .unwrap();
-
-    maestro.register_all(vec![Box::new(tenant), Box::new(alerting_score)]);
-    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/ntfy/src/main.rs
+++ b/examples/ntfy/src/main.rs
@@ -1,20 +1,18 @@
 use harmony::{
-    inventory::Inventory, maestro::Maestro, modules::monitoring::ntfy::ntfy::NtfyScore,
-    topology::K8sAnywhereTopology,
+    inventory::Inventory, modules::monitoring::ntfy::ntfy::NtfyScore, topology::K8sAnywhereTopology,
 };

 #[tokio::main]
 async fn main() {
-    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
+    harmony_cli::run(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
+        vec![Box::new(NtfyScore {
+            namespace: "monitoring".to_string(),
+            host: "localhost".to_string(),
+        })],
+        None,
    )
    .await
    .unwrap();
-
-    maestro.register_all(vec![Box::new(NtfyScore {
-        namespace: "monitoring".to_string(),
-        host: "localhost".to_string(),
-    })]);
-    harmony_cli::init(maestro, None).await.unwrap();
 }
--- a/examples/opnsense/Cargo.toml
+++ b/examples/opnsense/Cargo.toml
@@ -16,4 +16,3 @@ harmony_macros = { path = "../../harmony_macros" }
 log = { workspace = true }
 env_logger = { workspace = true }
 url = { workspace = true }
-harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
--- a/examples/opnsense/src/main.rs
+++ b/examples/opnsense/src/main.rs
@@ -13,7 +13,7 @@ use harmony::{
        dummy::{ErrorScore, PanicScore, SuccessScore},
        http::StaticFilesHttpScore,
        okd::{dhcp::OKDDhcpScore, dns::OKDDnsScore, load_balancer::OKDLoadBalancerScore},
-        opnsense::{OPNSenseLaunchUpgrade, OPNsenseShellCommandScore},
+        opnsense::OPNsenseShellCommandScore,
        tftp::TftpScore,
    },
    topology::{LogicalHost, UnmanagedRouter, Url},
@@ -22,10 +22,8 @@ use harmony_macros::{ip, mac_address};

 #[tokio::main]
 async fn main() {
-    env_logger::init();
-
    let firewall = harmony::topology::LogicalHost {
-        ip: ip!("192.168.122.106"),
+        ip: ip!("192.168.5.229"),
        name: String::from("opnsense-1"),
    };

@@ -97,12 +95,9 @@ async fn main() {
            opnsense: opnsense.get_opnsense_config(),
            command: "touch /tmp/helloharmonytouching".to_string(),
        }),
-        // Box::new(OPNSenseLaunchUpgrade {
-        //     opnsense: opnsense.get_opnsense_config(),
-        // }),
        Box::new(SuccessScore {}),
        Box::new(ErrorScore {}),
        Box::new(PanicScore {}),
    ]);
-    harmony_cli::init(maestro, None).await.unwrap();
+    harmony_tui::init(maestro).await.unwrap();
 }
--- a/examples/rust/.gitignore
+++ b/examples/rust/.gitignore
@@ -0,0 +1,3 @@
+Dockerfile.harmony
+.harmony_generated
+harmony
--- a/examples/rust/src/main.rs
+++ b/examples/rust/src/main.rs
@@ -2,42 +2,57 @@ use std::{path::PathBuf, sync::Arc};

 use harmony::{
    inventory::Inventory,
-    maestro::Maestro,
-    modules::application::{
-        ApplicationScore, RustWebFramework, RustWebapp,
-        features::{ContinuousDelivery, Monitoring},
+    modules::{
+        application::{
+            ApplicationScore, RustWebFramework, RustWebapp,
+            features::{ContinuousDelivery, Monitoring},
+        },
+        monitoring::alert_channel::{
+            discord_alert_channel::DiscordWebhook, webhook_receiver::WebhookReceiver,
+        },
    },
    topology::{K8sAnywhereTopology, Url},
 };

 #[tokio::main]
 async fn main() {
-    env_logger::init();
-
-    let topology = K8sAnywhereTopology::from_env();
-    let mut maestro = Maestro::initialize(Inventory::autoload(), topology)
-        .await
-        .unwrap();
-
    let application = Arc::new(RustWebapp {
        name: "harmony-example-rust-webapp".to_string(),
        domain: Url::Url(url::Url::parse("https://rustapp.harmony.example.com").unwrap()),
-        project_root: PathBuf::from("./examples/rust/webapp"),
+        project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
        framework: Some(RustWebFramework::Leptos),
    });

+    let discord_receiver = DiscordWebhook {
+        name: "test-discord".to_string(),
+        url: Url::Url(url::Url::parse("https://discord.doesnt.exist.com").unwrap()),
+    };
+
+    let webhook_receiver = WebhookReceiver {
+        name: "sample-webhook-receiver".to_string(),
+        url: Url::Url(url::Url::parse("https://webhook-doesnt-exist.com").unwrap()),
+    };
+
    let app = ApplicationScore {
        features: vec![
            Box::new(ContinuousDelivery {
                application: application.clone(),
-            }), // TODO add monitoring, backups, multisite ha, etc
+            }),
            Box::new(Monitoring {
                application: application.clone(),
+                alert_receiver: vec![Box::new(discord_receiver), Box::new(webhook_receiver)],
            }),
+            // TODO add backups, multisite ha, etc
        ],
        application,
    };

-    maestro.register_all(vec![Box::new(app)]);
-    harmony_cli::init(maestro, None).await.unwrap();
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(app)],
+        None,
+    )
+    .await
+    .unwrap();
 }
--- a/examples/rust/webapp/Dockerfile.harmony
+++ b/examples/rust/webapp/Dockerfile.harmony
@@ -1,16 +0,0 @@
-FROM rust:bookworm as builder
-RUN apt-get update && apt-get install -y --no-install-recommends clang wget && wget https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz && tar -xvf cargo-binstall-x86_64-unknown-linux-musl.tgz && cp cargo-binstall /usr/local/cargo/bin && rm cargo-binstall-x86_64-unknown-linux-musl.tgz cargo-binstall && apt-get clean && rm -rf /var/lib/apt/lists/*
-RUN cargo binstall cargo-leptos -y
-RUN rustup target add wasm32-unknown-unknown
-WORKDIR /app
-COPY . .
-RUN cargo leptos build --release -vv
-FROM debian:bookworm-slim
-RUN groupadd -r appgroup && useradd -r -s /bin/false -g appgroup appuser
-ENV LEPTOS_SITE_ADDR=0.0.0.0:3000
-EXPOSE 3000/tcp
-WORKDIR /home/appuser
-COPY --from=builder /app/target/site/pkg /home/appuser/pkg
-COPY --from=builder /app/target/release/harmony-example-rust-webapp /home/appuser/harmony-example-rust-webapp
-USER appuser
-CMD /home/appuser/harmony-example-rust-webapp
--- a/examples/tenant/src/main.rs
+++ b/examples/tenant/src/main.rs
@@ -1,7 +1,8 @@
+use std::str::FromStr;
+
 use harmony::{
    data::Id,
    inventory::Inventory,
-    maestro::Maestro,
    modules::tenant::TenantScore,
    topology::{K8sAnywhereTopology, tenant::TenantConfig},
 };
@@ -10,21 +11,20 @@ use harmony::{
 async fn main() {
    let tenant = TenantScore {
        config: TenantConfig {
-            id: Id::from_str("test-tenant-id"),
+            id: Id::from_str("test-tenant-id").unwrap(),
            name: "testtenant".to_string(),
            ..Default::default()
        },
    };

-    let mut maestro = Maestro::<K8sAnywhereTopology>::initialize(
+    harmony_cli::run(
        Inventory::autoload(),
        K8sAnywhereTopology::from_env(),
+        vec![Box::new(tenant)],
+        None,
    )
    .await
    .unwrap();
-
-    maestro.register_all(vec![Box::new(tenant)]);
-    harmony_cli::init(maestro, None).await.unwrap();
 }

 // TODO write tests
--- a/harmony/Cargo.toml
+++ b/harmony/Cargo.toml
@@ -5,6 +5,9 @@ version.workspace = true
 readme.workspace = true
 license.workspace = true

+[features]
+testing = []
+
 [dependencies]
 rand = "0.9"
 hex = "0.4"
@@ -27,29 +30,28 @@ harmony_macros = { path = "../harmony_macros" }
 harmony_types = { path = "../harmony_types" }
 uuid.workspace = true
 url.workspace = true
-kube.workspace = true
+kube = { workspace = true, features = ["derive"] }
 k8s-openapi.workspace = true
 serde_yaml.workspace = true
 http.workspace = true
 serde-value.workspace = true
-inquire.workspace = true
 helm-wrapper-rs = "0.4.0"
 non-blank-string-rs = "1.0.4"
 k3d-rs = { path = "../k3d" }
-directories = "6.0.0"
-lazy_static = "1.5.0"
+directories.workspace = true
+lazy_static.workspace = true
 dockerfile_builder = "0.1.5"
 temp-file = "0.1.9"
 convert_case.workspace = true
 email_address = "0.2.9"
 chrono.workspace = true
 fqdn = { version = "0.4.6", features = [
-    "domain-label-cannot-start-or-end-with-hyphen",
-    "domain-label-length-limited-to-63",
-    "domain-name-without-special-chars",
-    "domain-name-length-limited-to-255",
-    "punycode",
-    "serde",
+  "domain-label-cannot-start-or-end-with-hyphen",
+  "domain-label-length-limited-to-63",
+  "domain-name-without-special-chars",
+  "domain-name-length-limited-to-255",
+  "punycode",
+  "serde",
 ] }
 temp-dir = "0.1.14"
 dyn-clone = "1.0.19"
@@ -57,12 +59,15 @@ similar.workspace = true
 futures-util = "0.3.31"
 tokio-util = "0.7.15"
 strum = { version = "0.27.1", features = ["derive"] }
-tempfile = "3.20.0"
+tempfile.workspace = true
 serde_with = "3.14.0"
+schemars = "0.8.22"
+kube-derive = "1.1.0"
 bollard.workspace = true
 tar.workspace = true
 base64.workspace = true
-figment.workspace = true
+once_cell = "1.21.3"
+harmony-secret-derive = { version = "0.1.0", path = "../harmony_secret_derive" }

 [dev-dependencies]
 pretty_assertions.workspace = true
--- a/harmony/harmony.rlib
+++ b/harmony/harmony.rlib
--- a/harmony/src/domain/config.rs
+++ b/harmony/src/domain/config.rs
@@ -1,66 +1,15 @@
-use figment::{
-    Error, Figment, Metadata, Profile, Provider,
-    providers::{Env, Format},
-    value::{Dict, Map},
-};
 use lazy_static::lazy_static;
-use serde::{Deserialize, Serialize};
 use std::path::PathBuf;

-#[derive(Debug, Deserialize, Serialize)]
-pub struct Config {
-    pub data_dir: PathBuf,
-    pub registry_url: String,
-    pub registry_project: String,
-    pub dry_run: bool,
-    pub run_upgrades: bool,
-}
-
-impl Default for Config {
-    fn default() -> Self {
-        Config {
-            data_dir: directories::BaseDirs::new()
-                .unwrap()
-                .data_dir()
-                .join("harmony"),
-            registry_url: "hub.nationtech.io".to_string(),
-            registry_project: "harmony".to_string(),
-            dry_run: true,
-            run_upgrades: false,
-        }
-    }
-}
-
-impl Config {
-    pub fn load() -> Result<Self, figment::Error> {
-        Figment::from(Config::default())
-            .merge(Env::prefixed("HARMONY_"))
-            .extract()
-    }
-
-    fn from<T: Provider>(provider: T) -> Result<Config, Error> {
-        Figment::from(provider).extract()
-    }
-
-    fn figment() -> Figment {
-        use figment::providers::Env;
-
-        // In reality, whatever the library desires.
-        Figment::from(Config::default()).merge(Env::prefixed("HARMONY_"))
-    }
-}
-
-impl Provider for Config {
-    fn metadata(&self) -> Metadata {
-        Metadata::named("Harmony Config")
-    }
-
-    fn data(&self) -> Result<Map<Profile, Dict>, Error> {
-        figment::providers::Serialized::defaults(Config::default()).data()
-    }
-
-    fn profile(&self) -> Option<Profile> {
-        // Optionally, a profile that's selected by default.
-        Some(Profile::Default)
-    }
+lazy_static! {
+    pub static ref HARMONY_DATA_DIR: PathBuf = directories::BaseDirs::new()
+        .unwrap()
+        .data_dir()
+        .join("harmony");
+    pub static ref REGISTRY_URL: String =
+        std::env::var("HARMONY_REGISTRY_URL").unwrap_or_else(|_| "hub.nationtech.io".to_string());
+    pub static ref REGISTRY_PROJECT: String =
+        std::env::var("HARMONY_REGISTRY_PROJECT").unwrap_or_else(|_| "harmony".to_string());
+    pub static ref DRY_RUN: bool =
+        std::env::var("HARMONY_DRY_RUN").is_ok_and(|value| value.parse().unwrap_or(false));
 }
--- a/harmony/src/domain/data/id.rs
+++ b/harmony/src/domain/data/id.rs
@@ -1,5 +1,6 @@
 use rand::distr::Alphanumeric;
 use rand::distr::SampleString;
+use std::str::FromStr;
 use std::time::SystemTime;
 use std::time::UNIX_EPOCH;

@@ -23,13 +24,13 @@ pub struct Id {
    value: String,
 }

-impl Id {
-    pub fn from_string(value: String) -> Self {
-        Self { value }
-    }
+impl FromStr for Id {
+    type Err = ();

-    pub fn from_str(value: &str) -> Self {
-        Self::from_string(value.to_string())
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(Id {
+            value: s.to_string(),
+        })
    }
 }

--- a/harmony/src/domain/data/version.rs
+++ b/harmony/src/domain/data/version.rs
@@ -47,7 +47,7 @@ impl serde::Serialize for Version {

 impl std::fmt::Display for Version {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        return self.value.fmt(f);
+        self.value.fmt(f)
    }
 }

--- a/harmony/src/domain/hardware/mod.rs
+++ b/harmony/src/domain/hardware/mod.rs
@@ -35,10 +35,9 @@ impl PhysicalHost {

    pub fn cluster_mac(&self) -> MacAddress {
        self.network
-            .get(0)
+            .first()
            .expect("Cluster physical host should have a network interface")
            .mac_address
-            .clone()
    }

    pub fn cpu(mut self, cpu_count: Option<u64>) -> Self {
--- a/harmony/src/domain/instrumentation.rs
+++ b/harmony/src/domain/instrumentation.rs
@@ -0,0 +1,82 @@
+use log::debug;
+use once_cell::sync::Lazy;
+use tokio::sync::broadcast;
+
+use crate::modules::application::ApplicationFeatureStatus;
+
+use super::{
+    interpret::{InterpretError, Outcome},
+    topology::TopologyStatus,
+};
+
+#[derive(Debug, Clone)]
+pub enum HarmonyEvent {
+    HarmonyStarted,
+    HarmonyFinished,
+    InterpretExecutionStarted {
+        execution_id: String,
+        topology: String,
+        interpret: String,
+        score: String,
+        message: String,
+    },
+    InterpretExecutionFinished {
+        execution_id: String,
+        topology: String,
+        interpret: String,
+        score: String,
+        outcome: Result<Outcome, InterpretError>,
+    },
+    TopologyStateChanged {
+        topology: String,
+        status: TopologyStatus,
+        message: Option<String>,
+    },
+    ApplicationFeatureStateChanged {
+        topology: String,
+        application: String,
+        feature: String,
+        status: ApplicationFeatureStatus,
+    },
+}
+
+static HARMONY_EVENT_BUS: Lazy<broadcast::Sender<HarmonyEvent>> = Lazy::new(|| {
+    // TODO: Adjust channel capacity
+    let (tx, _rx) = broadcast::channel(100);
+    tx
+});
+
+pub fn instrument(event: HarmonyEvent) -> Result<(), &'static str> {
+    if cfg!(any(test, feature = "testing")) {
+        let _ = event; // Suppress the "unused variable" warning for `event`
+        Ok(())
+    } else {
+        match HARMONY_EVENT_BUS.send(event) {
+            Ok(_) => Ok(()),
+            Err(_) => Err("send error: no subscribers"),
+        }
+    }
+}
+
+pub async fn subscribe<F, Fut>(name: &str, mut handler: F)
+where
+    F: FnMut(HarmonyEvent) -> Fut + Send + 'static,
+    Fut: Future<Output = bool> + Send,
+{
+    let mut rx = HARMONY_EVENT_BUS.subscribe();
+    debug!("[{name}] Service started. Listening for events...");
+    loop {
+        match rx.recv().await {
+            Ok(event) => {
+                if !handler(event).await {
+                    debug!("[{name}] Handler requested exit.");
+                    break;
+                }
+            }
+            Err(broadcast::error::RecvError::Lagged(n)) => {
+                debug!("[{name}] Lagged behind by {n} messages.");
+            }
+            Err(_) => break,
+        }
+    }
+}
--- a/harmony/src/domain/interpret/mod.rs
+++ b/harmony/src/domain/interpret/mod.rs
@@ -7,6 +7,7 @@ use super::{
    data::{Id, Version},
    executors::ExecutorError,
    inventory::Inventory,
+    topology::PreparationError,
 };

 pub enum InterpretName {
@@ -23,6 +24,14 @@ pub enum InterpretName {
    TenantInterpret,
    Application,
    ArgoCD,
+    Alerting,
+    Ntfy,
+    HelmChart,
+    HelmCommand,
+    K8sResource,
+    Lamp,
+    ApplicationMonitoring,
+    K8sPrometheusCrdAlerting,
 }

 impl std::fmt::Display for InterpretName {
@@ -41,6 +50,14 @@ impl std::fmt::Display for InterpretName {
            InterpretName::TenantInterpret => f.write_str("Tenant"),
            InterpretName::Application => f.write_str("Application"),
            InterpretName::ArgoCD => f.write_str("ArgoCD"),
+            InterpretName::Alerting => f.write_str("Alerting"),
+            InterpretName::Ntfy => f.write_str("Ntfy"),
+            InterpretName::HelmChart => f.write_str("HelmChart"),
+            InterpretName::HelmCommand => f.write_str("HelmCommand"),
+            InterpretName::K8sResource => f.write_str("K8sResource"),
+            InterpretName::Lamp => f.write_str("LAMP"),
+            InterpretName::ApplicationMonitoring => f.write_str("ApplicationMonitoring"),
+            InterpretName::K8sPrometheusCrdAlerting => f.write_str("K8sPrometheusCrdAlerting"),
        }
    }
 }
@@ -113,6 +130,14 @@ impl std::fmt::Display for InterpretError {
 }
 impl Error for InterpretError {}

+impl From<PreparationError> for InterpretError {
+    fn from(value: PreparationError) -> Self {
+        Self {
+            msg: format!("InterpretError : {value}"),
+        }
+    }
+}
+
 impl From<ExecutorError> for InterpretError {
    fn from(value: ExecutorError) -> Self {
        Self {
--- a/harmony/src/domain/maestro/mod.rs
+++ b/harmony/src/domain/maestro/mod.rs
@@ -1,12 +1,14 @@
-use std::sync::{Arc, Mutex, RwLock};
+use std::sync::{Arc, RwLock};

-use log::{info, warn};
+use log::{debug, warn};
+
+use crate::topology::TopologyStatus;

 use super::{
-    interpret::{InterpretError, InterpretStatus, Outcome},
+    interpret::{InterpretError, Outcome},
    inventory::Inventory,
    score::Score,
-    topology::Topology,
+    topology::{PreparationError, PreparationOutcome, Topology, TopologyState},
 };

 type ScoreVec<T> = Vec<Box<dyn Score<T>>>;
@@ -15,7 +17,7 @@ pub struct Maestro<T: Topology> {
    inventory: Inventory,
    topology: T,
    scores: Arc<RwLock<ScoreVec<T>>>,
-    topology_preparation_result: Mutex<Option<Outcome>>,
+    topology_state: TopologyState,
 }

 impl<T: Topology> Maestro<T> {
@@ -23,36 +25,46 @@ impl<T: Topology> Maestro<T> {
    ///
    /// This should rarely be used. Most of the time Maestro::initialize should be used instead.
    pub fn new_without_initialization(inventory: Inventory, topology: T) -> Self {
+        let topology_name = topology.name().to_string();
+
        Self {
            inventory,
            topology,
            scores: Arc::new(RwLock::new(Vec::new())),
-            topology_preparation_result: None.into(),
+            topology_state: TopologyState::new(topology_name),
        }
    }

-    pub async fn initialize(inventory: Inventory, topology: T) -> Result<Self, InterpretError> {
-        let instance = Self::new_without_initialization(inventory, topology);
+    pub async fn initialize(inventory: Inventory, topology: T) -> Result<Self, PreparationError> {
+        let mut instance = Self::new_without_initialization(inventory, topology);
        instance.prepare_topology().await?;
        Ok(instance)
    }

    /// Ensures the associated Topology is ready for operations.
    /// Delegates the readiness check and potential setup actions to the Topology.
-    pub async fn prepare_topology(&self) -> Result<Outcome, InterpretError> {
-        info!("Ensuring topology '{}' is ready...", self.topology.name());
-        let outcome = self.topology.ensure_ready().await?;
-        info!(
-            "Topology '{}' readiness check complete: {}",
-            self.topology.name(),
-            outcome.status
-        );
+    async fn prepare_topology(&mut self) -> Result<PreparationOutcome, PreparationError> {
+        self.topology_state.prepare();

-        self.topology_preparation_result
-            .lock()
-            .unwrap()
-            .replace(outcome.clone());
-        Ok(outcome)
+        let result = self.topology.ensure_ready().await;
+
+        match result {
+            Ok(outcome) => {
+                match outcome.clone() {
+                    PreparationOutcome::Success { details } => {
+                        self.topology_state.success(details);
+                    }
+                    PreparationOutcome::Noop => {
+                        self.topology_state.noop();
+                    }
+                };
+                Ok(outcome)
+            }
+            Err(err) => {
+                self.topology_state.error(err.to_string());
+                Err(err)
+            }
+        }
    }

    pub fn register_all(&mut self, mut scores: ScoreVec<T>) {
@@ -61,15 +73,7 @@ impl<T: Topology> Maestro<T> {
    }

    fn is_topology_initialized(&self) -> bool {
-        let result = self.topology_preparation_result.lock().unwrap();
-        if let Some(outcome) = result.as_ref() {
-            match outcome.status {
-                InterpretStatus::SUCCESS => return true,
-                _ => return false,
-            }
-        } else {
-            false
-        }
+        self.topology_state.status == TopologyStatus::Success
    }

    pub async fn interpret(&self, score: Box<dyn Score<T>>) -> Result<Outcome, InterpretError> {
@@ -80,11 +84,9 @@ impl<T: Topology> Maestro<T> {
                self.topology.name(),
            );
        }
-        info!("Running score {score:?}");
-        let interpret = score.create_interpret();
-        info!("Launching interpret {interpret:?}");
-        let result = interpret.execute(&self.inventory, &self.topology).await;
-        info!("Got result {result:?}");
+        debug!("Interpreting score {score:?}");
+        let result = score.interpret(&self.inventory, &self.topology).await;
+        debug!("Got result {result:?}");
        result
    }

--- a/harmony/src/domain/mod.rs
+++ b/harmony/src/domain/mod.rs
@@ -3,6 +3,7 @@ pub mod data;
 pub mod executors;
 pub mod filter;
 pub mod hardware;
+pub mod instrumentation;
 pub mod interpret;
 pub mod inventory;
 pub mod maestro;
--- a/harmony/src/domain/score.rs
+++ b/harmony/src/domain/score.rs
@@ -1,22 +1,62 @@
 use std::collections::BTreeMap;

+use async_trait::async_trait;
 use serde::Serialize;
 use serde_value::Value;

-use super::{interpret::Interpret, topology::Topology};
+use super::{
+    data::Id,
+    instrumentation::{self, HarmonyEvent},
+    interpret::{Interpret, InterpretError, Outcome},
+    inventory::Inventory,
+    topology::Topology,
+};

+#[async_trait]
 pub trait Score<T: Topology>:
    std::fmt::Debug + ScoreToString<T> + Send + Sync + CloneBoxScore<T> + SerializeScore<T>
 {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>>;
+    async fn interpret(
+        &self,
+        inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        let id = Id::default();
+        let interpret = self.create_interpret();
+
+        instrumentation::instrument(HarmonyEvent::InterpretExecutionStarted {
+            execution_id: id.clone().to_string(),
+            topology: topology.name().into(),
+            interpret: interpret.get_name().to_string(),
+            score: self.name(),
+            message: format!("{} running...", interpret.get_name()),
+        })
+        .unwrap();
+        let result = interpret.execute(inventory, topology).await;
+
+        instrumentation::instrument(HarmonyEvent::InterpretExecutionFinished {
+            execution_id: id.clone().to_string(),
+            topology: topology.name().into(),
+            interpret: interpret.get_name().to_string(),
+            score: self.name(),
+            outcome: result.clone(),
+        })
+        .unwrap();
+
+        result
+    }
+
    fn name(&self) -> String;
+
+    #[doc(hidden)]
+    fn create_interpret(&self) -> Box<dyn Interpret<T>>;
 }

 pub trait SerializeScore<T: Topology> {
    fn serialize(&self) -> Value;
 }

-impl<'de, S, T> SerializeScore<T> for S
+impl<S, T> SerializeScore<T> for S
 where
    T: Topology,
    S: Score<T> + Serialize,
@@ -24,7 +64,7 @@ where
    fn serialize(&self) -> Value {
        // TODO not sure if this is the right place to handle the error or it should bubble
        // up?
-        serde_value::to_value(&self).expect("Score should serialize successfully")
+        serde_value::to_value(self).expect("Score should serialize successfully")
    }
 }

--- a/harmony/src/domain/topology/ha_cluster.rs
+++ b/harmony/src/domain/topology/ha_cluster.rs
@@ -1,15 +1,9 @@
 use async_trait::async_trait;
 use harmony_macros::ip;
 use harmony_types::net::MacAddress;
-use log::error;
 use log::info;

-use crate::config::Config;
 use crate::executors::ExecutorError;
-use crate::interpret::InterpretError;
-use crate::interpret::Outcome;
-use crate::inventory::Inventory;
-use crate::topology::upgradeable::Upgradeable;

 use super::DHCPStaticEntry;
 use super::DhcpServer;
@@ -23,18 +17,17 @@ use super::K8sclient;
 use super::LoadBalancer;
 use super::LoadBalancerService;
 use super::LogicalHost;
+use super::PreparationError;
+use super::PreparationOutcome;
 use super::Router;
 use super::TftpServer;

 use super::Topology;
 use super::Url;
 use super::k8s::K8sClient;
-use std::fmt::Debug;
-use std::net::IpAddr;
-use std::str::FromStr;
 use std::sync::Arc;

-#[derive(Clone, Debug)]
+#[derive(Debug, Clone)]
 pub struct HAClusterTopology {
    pub domain_name: String,
    pub router: Arc<dyn Router>,
@@ -55,16 +48,10 @@ impl Topology for HAClusterTopology {
    fn name(&self) -> &str {
        "HAClusterTopology"
    }
-    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
-        error!(
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+        todo!(
            "ensure_ready, not entirely sure what it should do here, probably something like verify that the hosts are reachable and all services are up and ready."
-        );
-        let config = Config::load().expect("couldn't load config");
-
-        if config.run_upgrades {
-            self.upgrade(&Inventory::empty(), self).await?;
-        }
-        Ok(Outcome::success("for now do nothing".to_string()))
+        )
    }
 }

@@ -257,17 +244,12 @@ impl Topology for DummyInfra {
        todo!()
    }

-    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
        let dummy_msg = "This is a dummy infrastructure that does nothing";
        info!("{dummy_msg}");
-        Ok(Outcome::success(dummy_msg.to_string()))
-    }
-}
-
-#[async_trait]
-impl<T: Topology> Upgradeable<T> for DummyInfra {
-    async fn upgrade(&self, _inventory: &Inventory, _topology: &T) -> Result<(), InterpretError> {
-        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+        Ok(PreparationOutcome::Success {
+            details: dummy_msg.into(),
+        })
    }
 }

@@ -437,12 +419,3 @@ impl DnsServer for DummyInfra {
        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
    }
 }
-
-#[async_trait]
-impl<T: Topology> Upgradeable<T> for HAClusterTopology {
-    async fn upgrade(&self, inventory: &Inventory, topology: &T) -> Result<(), InterpretError> {
-        error!("TODO implement upgrades for all parts of the cluster");
-        self.firewall.upgrade(inventory, topology).await?;
-        Ok(())
-    }
-}
--- a/harmony/src/domain/topology/k8s.rs
+++ b/harmony/src/domain/topology/k8s.rs
@@ -1,5 +1,4 @@
 use derive_new::new;
-use futures_util::StreamExt;
 use k8s_openapi::{
    ClusterResourceScope, NamespaceResourceScope,
    api::{apps::v1::Deployment, core::v1::Pod},
@@ -17,16 +16,23 @@ use kube::{
    runtime::wait::await_condition,
 };
 use log::{debug, error, trace};
-use serde::de::DeserializeOwned;
-use similar::{DiffableStr, TextDiff};
-
-use crate::config::Config as HarmonyConfig;
+use serde::{Serialize, de::DeserializeOwned};
+use similar::TextDiff;

 #[derive(new, Clone)]
 pub struct K8sClient {
    client: Client,
 }

+impl Serialize for K8sClient {
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        todo!()
+    }
+}
+
 impl std::fmt::Debug for K8sClient {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        // This is a poor man's debug implementation for now as kube::Client does not provide much
@@ -60,13 +66,13 @@ impl K8sClient {
        }

        let establish = await_condition(api, name.as_str(), conditions::is_deployment_completed());
-        let t = if let Some(t) = timeout { t } else { 300 };
+        let t = timeout.unwrap_or(300);
        let res = tokio::time::timeout(std::time::Duration::from_secs(t), establish).await;

-        if let Ok(r) = res {
-            return Ok(());
+        if res.is_ok() {
+            Ok(())
        } else {
-            return Err("timed out while waiting for deployment".to_string());
+            Err("timed out while waiting for deployment".to_string())
        }
    }

@@ -105,7 +111,7 @@ impl K8sClient {
            .await;

        match res {
-            Err(e) => return Err(e.to_string()),
+            Err(e) => Err(e.to_string()),
            Ok(mut process) => {
                let status = process
                    .take_status()
@@ -114,14 +120,10 @@ impl K8sClient {
                    .expect("Couldn't unwrap status");

                if let Some(s) = status.status {
-                    debug!("Status: {}", s);
-                    if s == "Success" {
-                        return Ok(());
-                    } else {
-                        return Err(s);
-                    }
+                    debug!("Status: {} - {:?}", s, status.details);
+                    if s == "Success" { Ok(()) } else { Err(s) }
                } else {
-                    return Err("Couldn't get inner status of pod exec".to_string());
+                    Err("Couldn't get inner status of pod exec".to_string())
                }
            }
        }
@@ -156,16 +158,15 @@ impl K8sClient {
            .as_ref()
            .expect("K8s Resource should have a name");

-        let config = HarmonyConfig::load().expect("couldn't load config");
-
-        if config.dry_run {
+        if *crate::config::DRY_RUN {
            match api.get(name).await {
                Ok(current) => {
                    trace!("Received current value {current:#?}");
                    // The resource exists, so we calculate and display a diff.
                    println!("\nPerforming dry-run for resource: '{}'", name);
-                    let mut current_yaml = serde_yaml::to_value(&current)
-                        .expect(&format!("Could not serialize current value : {current:#?}"));
+                    let mut current_yaml = serde_yaml::to_value(&current).unwrap_or_else(|_| {
+                        panic!("Could not serialize current value : {current:#?}")
+                    });
                    if current_yaml.is_mapping() && current_yaml.get("status").is_some() {
                        let map = current_yaml.as_mapping_mut().unwrap();
                        let removed = map.remove_entry("status");
@@ -232,7 +233,7 @@ impl K8sClient {
        }
    }

-    pub async fn apply_many<K>(&self, resource: &Vec<K>, ns: Option<&str>) -> Result<Vec<K>, Error>
+    pub async fn apply_many<K>(&self, resource: &[K], ns: Option<&str>) -> Result<Vec<K>, Error>
    where
        K: Resource + Clone + std::fmt::Debug + DeserializeOwned + serde::Serialize,
        <K as Resource>::Scope: ApplyStrategy<K>,
@@ -248,7 +249,7 @@ impl K8sClient {

    pub async fn apply_yaml_many(
        &self,
-        yaml: &Vec<serde_yaml::Value>,
+        #[allow(clippy::ptr_arg)] yaml: &Vec<serde_yaml::Value>,
        ns: Option<&str>,
    ) -> Result<(), Error> {
        for y in yaml.iter() {
--- a/harmony/src/domain/topology/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere.rs
@@ -1,31 +1,46 @@
 use std::{process::Command, sync::Arc};

 use async_trait::async_trait;
-use figment::{Figment, providers::Env};
-use inquire::Confirm;
 use log::{debug, info, warn};
-use serde::{Deserialize, Serialize};
+use serde::Serialize;
 use tokio::sync::OnceCell;

 use crate::{
    executors::ExecutorError,
-    interpret::{InterpretError, Outcome},
+    interpret::InterpretStatus,
    inventory::Inventory,
-    maestro::Maestro,
-    modules::k3d::K3DInstallationScore,
-    topology::LocalhostTopology,
+    modules::{
+        k3d::K3DInstallationScore,
+        monitoring::kube_prometheus::crd::{
+            crd_alertmanager_config::CRDPrometheus,
+            prometheus_operator::prometheus_operator_helm_chart_score,
+        },
+        prometheus::{
+            k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
+            prometheus::PrometheusApplicationMonitoring,
+        },
+    },
+    score::Score,
 };

 use super::{
-    DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, Topology,
+    DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, PreparationError,
+    PreparationOutcome, Topology,
    k8s::K8sClient,
-    tenant::{TenantConfig, TenantManager, k8s::K8sTenantManager},
+    oberservability::monitoring::AlertReceiver,
+    tenant::{
+        TenantConfig, TenantManager,
+        k8s::K8sTenantManager,
+        network_policy::{
+            K3dNetworkPolicyStrategy, NetworkPolicyStrategy, NoopNetworkPolicyStrategy,
+        },
+    },
 };

 #[derive(Clone, Debug)]
 struct K8sState {
    client: Arc<K8sClient>,
-    _source: K8sSource,
+    source: K8sSource,
    message: String,
 }

@@ -59,8 +74,42 @@ impl K8sclient for K8sAnywhereTopology {
    }
 }

+#[async_trait]
+impl PrometheusApplicationMonitoring<CRDPrometheus> for K8sAnywhereTopology {
+    async fn install_prometheus(
+        &self,
+        sender: &CRDPrometheus,
+        inventory: &Inventory,
+        receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        let po_result = self.ensure_prometheus_operator(sender).await?;
+
+        if po_result == PreparationOutcome::Noop {
+            debug!("Skipping Prometheus CR installation due to missing operator.");
+            return Ok(po_result);
+        }
+
+        let result = self
+            .get_k8s_prometheus_application_score(sender.clone(), receivers)
+            .await
+            .interpret(inventory, self)
+            .await;
+
+        match result {
+            Ok(outcome) => match outcome.status {
+                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
+                    details: outcome.message,
+                }),
+                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
+                _ => Err(PreparationError::new(outcome.message)),
+            },
+            Err(err) => Err(PreparationError::new(err.to_string())),
+        }
+    }
+}
+
 impl Serialize for K8sAnywhereTopology {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
@@ -85,6 +134,19 @@ impl K8sAnywhereTopology {
        }
    }

+    async fn get_k8s_prometheus_application_score(
+        &self,
+        sender: CRDPrometheus,
+        receivers: Option<Vec<Box<dyn AlertReceiver<CRDPrometheus>>>>,
+    ) -> K8sPrometheusCRDAlertingScore {
+        K8sPrometheusCRDAlertingScore {
+            sender,
+            receivers: receivers.unwrap_or_default(),
+            service_monitors: vec![],
+            prometheus_rules: vec![],
+        }
+    }
+
    fn is_helm_available(&self) -> Result<(), String> {
        let version_result = Command::new("helm")
            .arg("version")
@@ -95,9 +157,8 @@ impl K8sAnywhereTopology {
            return Err("Failed to run 'helm -version'".to_string());
        }

-        // Print the version output
        let version_output = String::from_utf8_lossy(&version_result.stdout);
-        println!("Helm version: {}", version_output.trim());
+        debug!("Helm version: {}", version_output.trim());

        Ok(())
    }
@@ -114,33 +175,42 @@ impl K8sAnywhereTopology {
        K3DInstallationScore::default()
    }

-    async fn try_install_k3d(&self) -> Result<(), InterpretError> {
-        let maestro = Maestro::initialize(Inventory::autoload(), LocalhostTopology::new()).await?;
-        let k3d_score = self.get_k3d_installation_score();
-        maestro.interpret(Box::new(k3d_score)).await?;
-        Ok(())
+    async fn try_install_k3d(&self) -> Result<(), PreparationError> {
+        let result = self
+            .get_k3d_installation_score()
+            .interpret(&Inventory::empty(), self)
+            .await;
+
+        match result {
+            Ok(outcome) => match outcome.status {
+                InterpretStatus::SUCCESS => Ok(()),
+                InterpretStatus::NOOP => Ok(()),
+                _ => Err(PreparationError::new(outcome.message)),
+            },
+            Err(err) => Err(PreparationError::new(err.to_string())),
+        }
    }

-    async fn try_get_or_install_k8s_client(&self) -> Result<Option<K8sState>, InterpretError> {
+    async fn try_get_or_install_k8s_client(&self) -> Result<Option<K8sState>, PreparationError> {
        let k8s_anywhere_config = &self.config;

        // TODO this deserves some refactoring, it is becoming a bit hard to figure out
        // be careful when making modifications here
        if k8s_anywhere_config.use_local_k3d {
-            info!("Using local k3d cluster because of use_local_k3d set to true");
+            debug!("Using local k3d cluster because of use_local_k3d set to true");
        } else {
            if let Some(kubeconfig) = &k8s_anywhere_config.kubeconfig {
                debug!("Loading kubeconfig {kubeconfig}");
-                match self.try_load_kubeconfig(&kubeconfig).await {
+                match self.try_load_kubeconfig(kubeconfig).await {
                    Some(client) => {
                        return Ok(Some(K8sState {
                            client: Arc::new(client),
-                            _source: K8sSource::Kubeconfig,
+                            source: K8sSource::Kubeconfig,
                            message: format!("Loaded k8s client from kubeconfig {kubeconfig}"),
                        }));
                    }
                    None => {
-                        return Err(InterpretError::new(format!(
+                        return Err(PreparationError::new(format!(
                            "Failed to load kubeconfig from {kubeconfig}"
                        )));
                    }
@@ -159,22 +229,13 @@ impl K8sAnywhereTopology {
        }

        if !k8s_anywhere_config.autoinstall {
-            debug!("Autoinstall confirmation prompt");
-            let confirmation = Confirm::new( "Harmony autoinstallation is not activated, do you wish to launch autoinstallation? : ")
-                .with_default(false)
-                .prompt()
-                .expect("Unexpected prompt error");
-            debug!("Autoinstall confirmation {confirmation}");
-
-            if !confirmation {
-                warn!(
-                    "Installation cancelled, K8sAnywhere could not initialize a valid Kubernetes client"
-                );
-                return Ok(None);
-            }
+            warn!(
+                "Installation cancelled, K8sAnywhere could not initialize a valid Kubernetes client"
+            );
+            return Ok(None);
        }

-        info!("Starting K8sAnywhere installation");
+        debug!("Starting K8sAnywhere installation");
        self.try_install_k3d().await?;
        let k3d_score = self.get_k3d_installation_score();
        // I feel like having to rely on the k3d_rs crate here is a smell
@@ -186,8 +247,8 @@ impl K8sAnywhereTopology {
        let state = match k3d.get_client().await {
            Ok(client) => K8sState {
                client: Arc::new(K8sClient::new(client)),
-                _source: K8sSource::LocalK3d,
-                message: "Successfully installed K3D cluster and acquired client".to_string(),
+                source: K8sSource::LocalK3d,
+                message: "K8s client ready".to_string(),
            },
            Err(_) => todo!(),
        };
@@ -195,15 +256,21 @@ impl K8sAnywhereTopology {
        Ok(Some(state))
    }

-    async fn ensure_k8s_tenant_manager(&self) -> Result<(), String> {
-        if let Some(_) = self.tenant_manager.get() {
+    async fn ensure_k8s_tenant_manager(&self, k8s_state: &K8sState) -> Result<(), String> {
+        if self.tenant_manager.get().is_some() {
            return Ok(());
        }

        self.tenant_manager
            .get_or_try_init(async || -> Result<K8sTenantManager, String> {
                let k8s_client = self.k8s_client().await?;
-                Ok(K8sTenantManager::new(k8s_client))
+                let network_policy_strategy: Box<dyn NetworkPolicyStrategy> = match k8s_state.source
+                {
+                    K8sSource::LocalK3d => Box::new(K3dNetworkPolicyStrategy::new()),
+                    K8sSource::Kubeconfig => Box::new(NoopNetworkPolicyStrategy::new()),
+                };
+
+                Ok(K8sTenantManager::new(k8s_client, network_policy_strategy))
            })
            .await?;

@@ -218,9 +285,58 @@ impl K8sAnywhereTopology {
            )),
        }
    }
+
+    async fn ensure_prometheus_operator(
+        &self,
+        sender: &CRDPrometheus,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        let status = Command::new("sh")
+            .args(["-c", "kubectl get crd -A | grep -i prometheuses"])
+            .status()
+            .map_err(|e| PreparationError::new(format!("could not connect to cluster: {}", e)))?;
+
+        if !status.success() {
+            if let Some(Some(k8s_state)) = self.k8s_state.get() {
+                match k8s_state.source {
+                    K8sSource::LocalK3d => {
+                        debug!("installing prometheus operator");
+                        let op_score =
+                            prometheus_operator_helm_chart_score(sender.namespace.clone());
+                        let result = op_score.interpret(&Inventory::empty(), self).await;
+
+                        return match result {
+                            Ok(outcome) => match outcome.status {
+                                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
+                                    details: "installed prometheus operator".into(),
+                                }),
+                                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
+                                _ => Err(PreparationError::new(
+                                    "failed to install prometheus operator (unknown error)".into(),
+                                )),
+                            },
+                            Err(err) => Err(PreparationError::new(err.to_string())),
+                        };
+                    }
+                    K8sSource::Kubeconfig => {
+                        debug!("unable to install prometheus operator, contact cluster admin");
+                        return Ok(PreparationOutcome::Noop);
+                    }
+                }
+            } else {
+                warn!("Unable to detect k8s_state. Skipping Prometheus Operator install.");
+                return Ok(PreparationOutcome::Noop);
+            }
+        }
+
+        debug!("Prometheus operator is already present, skipping install");
+
+        Ok(PreparationOutcome::Success {
+            details: "prometheus operator present in cluster".into(),
+        })
+    }
 }

-#[derive(Clone, Debug, Deserialize)]
+#[derive(Clone, Debug)]
 pub struct K8sAnywhereConfig {
    /// The path of the KUBECONFIG file that Harmony should use to interact with the Kubernetes
    /// cluster
@@ -238,7 +354,7 @@ pub struct K8sAnywhereConfig {
    ///
    /// When enabled, autoinstall will setup a K3D cluster on the localhost. https://k3d.io/stable/
    ///
-    /// Default: false
+    /// Default: true
    pub autoinstall: bool,

    /// Whether to use local k3d cluster.
@@ -247,29 +363,25 @@ pub struct K8sAnywhereConfig {
    ///
    /// default: true
    pub use_local_k3d: bool,
-    pub profile: String,
-}
-
-impl Default for K8sAnywhereConfig {
-    fn default() -> Self {
-        Self {
-            kubeconfig: None,
-            use_system_kubeconfig: false,
-            autoinstall: false,
-            // TODO harmony_profile should be managed at a more core level than this
-            profile: "dev".to_string(),
-            use_local_k3d: true,
-        }
-    }
+    pub harmony_profile: String,
 }

 impl K8sAnywhereConfig {
    fn from_env() -> Self {
-        Figment::new()
-            .merge(Env::prefixed("HARMONY_"))
-            .merge(Env::raw().only(&["KUBECONFIG"]))
-            .extract()
-            .expect("couldn't load config from env")
+        Self {
+            kubeconfig: std::env::var("KUBECONFIG").ok().map(|v| v.to_string()),
+            use_system_kubeconfig: std::env::var("HARMONY_USE_SYSTEM_KUBECONFIG")
+                .map_or_else(|_| false, |v| v.parse().ok().unwrap_or(false)),
+            autoinstall: std::env::var("HARMONY_AUTOINSTALL")
+                .map_or_else(|_| true, |v| v.parse().ok().unwrap_or(false)),
+            // TODO harmony_profile should be managed at a more core level than this
+            harmony_profile: std::env::var("HARMONY_PROFILE").map_or_else(
+                |_| "dev".to_string(),
+                |v| v.parse().ok().unwrap_or("dev".to_string()),
+            ),
+            use_local_k3d: std::env::var("HARMONY_USE_LOCAL_K3D")
+                .map_or_else(|_| true, |v| v.parse().ok().unwrap_or(true)),
+        }
    }
 }

@@ -279,26 +391,25 @@ impl Topology for K8sAnywhereTopology {
        "K8sAnywhereTopology"
    }

-    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
        let k8s_state = self
            .k8s_state
            .get_or_try_init(|| self.try_get_or_install_k8s_client())
            .await?;

-        let k8s_state: &K8sState = k8s_state.as_ref().ok_or(InterpretError::new(
-            "No K8s client could be found or installed".to_string(),
+        let k8s_state: &K8sState = k8s_state.as_ref().ok_or(PreparationError::new(
+            "no K8s client could be found or installed".to_string(),
        ))?;

-        self.ensure_k8s_tenant_manager()
+        self.ensure_k8s_tenant_manager(k8s_state)
            .await
-            .map_err(|e| InterpretError::new(e))?;
+            .map_err(PreparationError::new)?;

        match self.is_helm_available() {
-            Ok(()) => Ok(Outcome::success(format!(
-                "{} + helm available",
-                k8s_state.message.clone()
-            ))),
-            Err(e) => Err(InterpretError::new(format!("helm unavailable: {}", e))),
+            Ok(()) => Ok(PreparationOutcome::Success {
+                details: format!("{} + helm available", k8s_state.message.clone()),
+            }),
+            Err(e) => Err(PreparationError::new(format!("helm unavailable: {}", e))),
        }
    }
 }
@@ -309,7 +420,7 @@ impl MultiTargetTopology for K8sAnywhereTopology {
            return DeploymentTarget::LocalDev;
        }

-        match self.config.profile.to_lowercase().as_str() {
+        match self.config.harmony_profile.to_lowercase().as_str() {
            "staging" => DeploymentTarget::Staging,
            "production" => DeploymentTarget::Production,
            _ => todo!("HARMONY_PROFILE must be set when use_local_k3d is not set"),
--- a/harmony/src/domain/topology/localhost.rs
+++ b/harmony/src/domain/topology/localhost.rs
@@ -1,9 +1,7 @@
 use async_trait::async_trait;
 use derive_new::new;

-use crate::interpret::{InterpretError, Outcome};
-
-use super::{HelmCommand, Topology};
+use super::{HelmCommand, PreparationError, PreparationOutcome, Topology};

 #[derive(new)]
 pub struct LocalhostTopology;
@@ -14,10 +12,10 @@ impl Topology for LocalhostTopology {
        "LocalHostTopology"
    }

-    async fn ensure_ready(&self) -> Result<Outcome, InterpretError> {
-        Ok(Outcome::success(
-            "Localhost is Chuck Norris, always ready.".to_string(),
-        ))
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+        Ok(PreparationOutcome::Success {
+            details: "Localhost is Chuck Norris, always ready.".into(),
+        })
    }
 }

--- a/harmony/src/domain/topology/mod.rs
+++ b/harmony/src/domain/topology/mod.rs
@@ -6,7 +6,7 @@ mod k8s_anywhere;
 mod localhost;
 pub mod oberservability;
 pub mod tenant;
-pub mod upgradeable;
+use derive_new::new;
 pub use k8s_anywhere::*;
 pub use localhost::*;
 pub mod k8s;
@@ -27,10 +27,13 @@ pub use tftp::*;
 mod helm_command;
 pub use helm_command::*;

+use super::{
+    executors::ExecutorError,
+    instrumentation::{self, HarmonyEvent},
+};
+use std::error::Error;
 use std::net::IpAddr;

-use super::interpret::{InterpretError, Outcome};
-
 /// Represents a logical view of an infrastructure environment providing specific capabilities.
 ///
 /// A Topology acts as a self-contained "package" responsible for managing access
@@ -58,9 +61,128 @@ pub trait Topology: Send + Sync {
    ///     *   **Internal Orchestration:** For complex topologies, this method might manage dependencies on other sub-topologies, ensuring *their* `ensure_ready` is called first. Using nested `Maestros` to run setup `Scores` against these sub-topologies is the recommended pattern for non-trivial bootstrapping, allowing reuse of Harmony's core orchestration logic.
    ///
    /// # Returns
-    /// - `Ok(Outcome)`: Indicates the topology is now ready. The `Outcome` status might be `SUCCESS` if actions were taken, or `NOOP` if it was already ready. The message should provide context.
-    /// - `Err(TopologyError)`: Indicates the topology could not reach a ready state due to configuration issues, discovery failures, bootstrap errors, or unsupported environments.
-    async fn ensure_ready(&self) -> Result<Outcome, InterpretError>;
+    /// - `Ok(PreparationOutcome)`: Indicates the topology is now ready. The `Outcome` status might be `SUCCESS` if actions were taken, or `NOOP` if it was already ready. The message should provide context.
+    /// - `Err(PreparationError)`: Indicates the topology could not reach a ready state due to configuration issues, discovery failures, bootstrap errors, or unsupported environments.
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError>;
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PreparationOutcome {
+    Success { details: String },
+    Noop,
+}
+
+#[derive(Debug, Clone, new)]
+pub struct PreparationError {
+    msg: String,
+}
+
+impl std::fmt::Display for PreparationError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.msg)
+    }
+}
+
+impl Error for PreparationError {}
+
+impl From<ExecutorError> for PreparationError {
+    fn from(value: ExecutorError) -> Self {
+        Self {
+            msg: format!("InterpretError : {value}"),
+        }
+    }
+}
+
+impl From<kube::Error> for PreparationError {
+    fn from(value: kube::Error) -> Self {
+        Self {
+            msg: format!("PreparationError : {value}"),
+        }
+    }
+}
+
+impl From<String> for PreparationError {
+    fn from(value: String) -> Self {
+        Self {
+            msg: format!("PreparationError : {value}"),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum TopologyStatus {
+    Queued,
+    Preparing,
+    Success,
+    Noop,
+    Error,
+}
+
+pub struct TopologyState {
+    pub topology: String,
+    pub status: TopologyStatus,
+}
+
+impl TopologyState {
+    pub fn new(topology: String) -> Self {
+        let instance = Self {
+            topology,
+            status: TopologyStatus::Queued,
+        };
+
+        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
+            topology: instance.topology.clone(),
+            status: instance.status.clone(),
+            message: None,
+        })
+        .unwrap();
+
+        instance
+    }
+
+    pub fn prepare(&mut self) {
+        self.status = TopologyStatus::Preparing;
+
+        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
+            topology: self.topology.clone(),
+            status: self.status.clone(),
+            message: None,
+        })
+        .unwrap();
+    }
+
+    pub fn success(&mut self, message: String) {
+        self.status = TopologyStatus::Success;
+
+        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
+            topology: self.topology.clone(),
+            status: self.status.clone(),
+            message: Some(message),
+        })
+        .unwrap();
+    }
+
+    pub fn noop(&mut self) {
+        self.status = TopologyStatus::Noop;
+
+        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
+            topology: self.topology.clone(),
+            status: self.status.clone(),
+            message: None,
+        })
+        .unwrap();
+    }
+
+    pub fn error(&mut self, message: String) {
+        self.status = TopologyStatus::Error;
+
+        instrumentation::instrument(HarmonyEvent::TopologyStateChanged {
+            topology: self.topology.clone(),
+            status: self.status.clone(),
+            message: Some(message),
+        })
+        .unwrap();
+    }
 }

 #[derive(Debug)]
@@ -89,7 +211,7 @@ impl Serialize for Url {
    {
        match self {
            Url::LocalFolder(path) => serializer.serialize_str(path),
-            Url::Url(url) => serializer.serialize_str(&url.as_str()),
+            Url::Url(url) => serializer.serialize_str(url.as_str()),
        }
    }
 }
--- a/harmony/src/domain/topology/network.rs
+++ b/harmony/src/domain/topology/network.rs
@@ -2,15 +2,9 @@ use std::{net::Ipv4Addr, str::FromStr, sync::Arc};

 use async_trait::async_trait;
 use harmony_types::net::MacAddress;
-use log::debug;
 use serde::Serialize;

-use crate::{
-    executors::ExecutorError,
-    interpret::InterpretError,
-    inventory::Inventory,
-    topology::{Topology, upgradeable::Upgradeable},
-};
+use crate::executors::ExecutorError;

 use super::{IpAddress, LogicalHost, k8s::K8sClient};

@@ -44,15 +38,6 @@ impl std::fmt::Debug for dyn Firewall {
    }
 }

-// #[async_trait]
-// impl<T: Topology> Upgradeable<T> for dyn Firewall {
-//     async fn upgrade(&self, inventory: &Inventory, topology: &T) -> Result<(), InterpretError> {
-//         debug!("upgrading");
-//         self.upgrade(inventory, topology).await?;
-//         Ok(())
-//     }
-// }
-
 pub struct NetworkDomain {
    pub name: String,
 }
--- a/harmony/src/domain/topology/oberservability/monitoring.rs
+++ b/harmony/src/domain/topology/oberservability/monitoring.rs
@@ -1,3 +1,5 @@
+use std::any::Any;
+
 use async_trait::async_trait;
 use log::debug;

@@ -43,7 +45,7 @@ impl<S: AlertSender + Installable<T>, T: Topology> Interpret<T> for AlertingInte
    }

    fn get_name(&self) -> InterpretName {
-        todo!()
+        InterpretName::Alerting
    }

    fn get_version(&self) -> Version {
@@ -62,7 +64,9 @@ impl<S: AlertSender + Installable<T>, T: Topology> Interpret<T> for AlertingInte
 #[async_trait]
 pub trait AlertReceiver<S: AlertSender>: std::fmt::Debug + Send + Sync {
    async fn install(&self, sender: &S) -> Result<Outcome, InterpretError>;
+    fn name(&self) -> String;
    fn clone_box(&self) -> Box<dyn AlertReceiver<S>>;
+    fn as_any(&self) -> &dyn Any;
 }

 #[async_trait]
@@ -72,6 +76,6 @@ pub trait AlertRule<S: AlertSender>: std::fmt::Debug + Send + Sync {
 }

 #[async_trait]
-pub trait ScrapeTarger<S: AlertSender> {
+pub trait ScrapeTarget<S: AlertSender> {
    async fn install(&self, sender: &S) -> Result<(), InterpretError>;
 }
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -27,11 +27,11 @@ pub struct UnmanagedRouter {

 impl Router for UnmanagedRouter {
    fn get_gateway(&self) -> IpAddress {
-        self.gateway.clone()
+        self.gateway
    }

    fn get_cidr(&self) -> Ipv4Cidr {
-        self.cidr.clone()
+        self.cidr
    }

    fn get_host(&self) -> LogicalHost {
--- a/harmony/src/domain/topology/tenant/k8s.rs
+++ b/harmony/src/domain/topology/tenant/k8s.rs
@@ -15,36 +15,38 @@ use k8s_openapi::{
    apimachinery::pkg::util::intstr::IntOrString,
 };
 use kube::Resource;
-use log::{debug, info, warn};
+use log::debug;
 use serde::de::DeserializeOwned;
 use serde_json::json;
 use tokio::sync::OnceCell;

-use super::{TenantConfig, TenantManager};
+use super::{TenantConfig, TenantManager, network_policy::NetworkPolicyStrategy};

-#[derive(Clone, Debug)]
+#[derive(Debug)]
 pub struct K8sTenantManager {
    k8s_client: Arc<K8sClient>,
    k8s_tenant_config: Arc<OnceCell<TenantConfig>>,
+    network_policy_strategy: Box<dyn NetworkPolicyStrategy>,
 }

 impl K8sTenantManager {
-    pub fn new(client: Arc<K8sClient>) -> Self {
+    pub fn new(
+        client: Arc<K8sClient>,
+        network_policy_strategy: Box<dyn NetworkPolicyStrategy>,
+    ) -> Self {
        Self {
            k8s_client: client,
            k8s_tenant_config: Arc::new(OnceCell::new()),
+            network_policy_strategy,
        }
    }
-}

-impl K8sTenantManager {
    fn get_namespace_name(&self, config: &TenantConfig) -> String {
        config.name.clone()
    }

    fn ensure_constraints(&self, _namespace: &Namespace) -> Result<(), ExecutorError> {
-        warn!("Validate that when tenant already exists (by id) that name has not changed");
-        warn!("Make sure other Tenant constraints are respected by this k8s implementation");
+        // TODO: Ensure constraints are applied to namespace (https://git.nationtech.io/NationTech/harmony/issues/98)
        Ok(())
    }

@@ -219,24 +221,6 @@ impl K8sTenantManager {
                  }
                ]
              },
-              {
-                "to": [
-                  {
-                "ipBlock": {
-                    "cidr": "10.43.0.1/32",
-                    }
-                  }
-                ]
-              },
-              {
-                "to": [
-                  {
-                "ipBlock": {
-                    "cidr": "172.23.0.0/16",
-                    }
-                  }
-                ]
-              },
              {
                "to": [
                  {
@@ -304,19 +288,19 @@ impl K8sTenantManager {
                let ports: Option<Vec<NetworkPolicyPort>> =
                    c.1.as_ref().map(|spec| match &spec.data {
                        super::PortSpecData::SinglePort(port) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int(port.clone().into())),
+                            port: Some(IntOrString::Int((*port).into())),
                            ..Default::default()
                        }],
                        super::PortSpecData::PortRange(start, end) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int(start.clone().into())),
-                            end_port: Some(end.clone().into()),
+                            port: Some(IntOrString::Int((*start).into())),
+                            end_port: Some((*end).into()),
                            protocol: None, // Not currently supported by Harmony
                        }],

                        super::PortSpecData::ListOfPorts(items) => items
                            .iter()
                            .map(|i| NetworkPolicyPort {
-                                port: Some(IntOrString::Int(i.clone().into())),
+                                port: Some(IntOrString::Int((*i).into())),
                                ..Default::default()
                            })
                            .collect(),
@@ -361,19 +345,19 @@ impl K8sTenantManager {
                let ports: Option<Vec<NetworkPolicyPort>> =
                    c.1.as_ref().map(|spec| match &spec.data {
                        super::PortSpecData::SinglePort(port) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int(port.clone().into())),
+                            port: Some(IntOrString::Int((*port).into())),
                            ..Default::default()
                        }],
                        super::PortSpecData::PortRange(start, end) => vec![NetworkPolicyPort {
-                            port: Some(IntOrString::Int(start.clone().into())),
-                            end_port: Some(end.clone().into()),
+                            port: Some(IntOrString::Int((*start).into())),
+                            end_port: Some((*end).into()),
                            protocol: None, // Not currently supported by Harmony
                        }],

                        super::PortSpecData::ListOfPorts(items) => items
                            .iter()
                            .map(|i| NetworkPolicyPort {
-                                port: Some(IntOrString::Int(i.clone().into())),
+                                port: Some(IntOrString::Int((*i).into())),
                                ..Default::default()
                            })
                            .collect(),
@@ -406,12 +390,27 @@ impl K8sTenantManager {
    }
 }

+impl Clone for K8sTenantManager {
+    fn clone(&self) -> Self {
+        Self {
+            k8s_client: self.k8s_client.clone(),
+            k8s_tenant_config: self.k8s_tenant_config.clone(),
+            network_policy_strategy: self.network_policy_strategy.clone_box(),
+        }
+    }
+}
+
 #[async_trait]
 impl TenantManager for K8sTenantManager {
    async fn provision_tenant(&self, config: &TenantConfig) -> Result<(), ExecutorError> {
        let namespace = self.build_namespace(config)?;
        let resource_quota = self.build_resource_quota(config)?;
+
        let network_policy = self.build_network_policy(config)?;
+        let network_policy = self
+            .network_policy_strategy
+            .adjust_policy(network_policy, config);
+
        let resource_limit_range = self.build_limit_range(config)?;

        self.ensure_constraints(&namespace)?;
@@ -428,13 +427,14 @@ impl TenantManager for K8sTenantManager {
        debug!("Creating network_policy for tenant {}", config.name);
        self.apply_resource(network_policy, config).await?;

-        info!(
+        debug!(
            "Success provisionning K8s tenant id {} name {}",
            config.id, config.name
        );
        self.store_config(config);
        Ok(())
    }
+
    async fn get_tenant_config(&self) -> Option<TenantConfig> {
        self.k8s_tenant_config.get().cloned()
    }
--- a/harmony/src/domain/topology/tenant/mod.rs
+++ b/harmony/src/domain/topology/tenant/mod.rs
@@ -1,11 +1,11 @@
 pub mod k8s;
 mod manager;
-use std::str::FromStr;
-
-pub use manager::*;
-use serde::{Deserialize, Serialize};
+pub mod network_policy;

 use crate::data::Id;
+pub use manager::*;
+use serde::{Deserialize, Serialize};
+use std::str::FromStr;

 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] // Assuming serde for Scores
 pub struct TenantConfig {
--- a/harmony/src/domain/topology/tenant/network_policy.rs
+++ b/harmony/src/domain/topology/tenant/network_policy.rs
@@ -0,0 +1,120 @@
+use k8s_openapi::api::networking::v1::{
+    IPBlock, NetworkPolicy, NetworkPolicyEgressRule, NetworkPolicyPeer, NetworkPolicySpec,
+};
+
+use super::TenantConfig;
+
+pub trait NetworkPolicyStrategy: Send + Sync + std::fmt::Debug {
+    fn clone_box(&self) -> Box<dyn NetworkPolicyStrategy>;
+
+    fn adjust_policy(&self, policy: NetworkPolicy, config: &TenantConfig) -> NetworkPolicy;
+}
+
+#[derive(Clone, Debug)]
+pub struct NoopNetworkPolicyStrategy {}
+
+impl NoopNetworkPolicyStrategy {
+    pub fn new() -> Self {
+        Self {}
+    }
+}
+
+impl Default for NoopNetworkPolicyStrategy {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl NetworkPolicyStrategy for NoopNetworkPolicyStrategy {
+    fn clone_box(&self) -> Box<dyn NetworkPolicyStrategy> {
+        Box::new(self.clone())
+    }
+
+    fn adjust_policy(&self, policy: NetworkPolicy, _config: &TenantConfig) -> NetworkPolicy {
+        policy
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct K3dNetworkPolicyStrategy {}
+
+impl K3dNetworkPolicyStrategy {
+    pub fn new() -> Self {
+        Self {}
+    }
+}
+
+impl Default for K3dNetworkPolicyStrategy {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl NetworkPolicyStrategy for K3dNetworkPolicyStrategy {
+    fn clone_box(&self) -> Box<dyn NetworkPolicyStrategy> {
+        Box::new(self.clone())
+    }
+
+    fn adjust_policy(&self, policy: NetworkPolicy, _config: &TenantConfig) -> NetworkPolicy {
+        let mut egress = policy
+            .spec
+            .clone()
+            .unwrap_or_default()
+            .egress
+            .clone()
+            .unwrap_or_default();
+        egress.push(NetworkPolicyEgressRule {
+            to: Some(vec![NetworkPolicyPeer {
+                ip_block: Some(IPBlock {
+                    cidr: "172.18.0.0/16".into(), // TODO: query the IP range https://git.nationtech.io/NationTech/harmony/issues/108
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }]),
+            ..Default::default()
+        });
+
+        NetworkPolicy {
+            spec: Some(NetworkPolicySpec {
+                egress: Some(egress),
+                ..policy.spec.unwrap_or_default()
+            }),
+            ..policy
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use k8s_openapi::api::networking::v1::{
+        IPBlock, NetworkPolicy, NetworkPolicyEgressRule, NetworkPolicyPeer, NetworkPolicySpec,
+    };
+
+    use super::{K3dNetworkPolicyStrategy, NetworkPolicyStrategy};
+
+    #[test]
+    pub fn should_add_ip_block_for_k3d_harmony_server() {
+        let strategy = K3dNetworkPolicyStrategy::new();
+
+        let policy =
+            strategy.adjust_policy(NetworkPolicy::default(), &super::TenantConfig::default());
+
+        let expected_policy = NetworkPolicy {
+            spec: Some(NetworkPolicySpec {
+                egress: Some(vec![NetworkPolicyEgressRule {
+                    to: Some(vec![NetworkPolicyPeer {
+                        ip_block: Some(IPBlock {
+                            cidr: "172.18.0.0/16".into(),
+                            ..Default::default()
+                        }),
+                        ..Default::default()
+                    }]),
+                    ..Default::default()
+                }]),
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        assert_eq!(expected_policy, policy);
+    }
+}
--- a/harmony/src/domain/topology/upgradeable.rs
+++ b/harmony/src/domain/topology/upgradeable.rs
@@ -1,8 +0,0 @@
-use async_trait::async_trait;
-
-use crate::{interpret::InterpretError, inventory::Inventory};
-
-#[async_trait]
-pub trait Upgradeable<T>: Send + Sync {
-    async fn upgrade(&self, inventory: &Inventory, topology: &T) -> Result<(), InterpretError>;
-}
--- a/harmony/src/infra/opnsense/dns.rs
+++ b/harmony/src/infra/opnsense/dns.rs
@@ -60,7 +60,7 @@ impl DnsServer for OPNSenseFirewall {
    }

    fn get_ip(&self) -> IpAddress {
-        OPNSenseFirewall::get_ip(&self)
+        OPNSenseFirewall::get_ip(self)
    }

    fn get_host(&self) -> LogicalHost {
--- a/harmony/src/infra/opnsense/http.rs
+++ b/harmony/src/infra/opnsense/http.rs
@@ -48,7 +48,7 @@ impl HttpServer for OPNSenseFirewall {
    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
        let mut config = self.opnsense_config.write().await;
        let caddy = config.caddy();
-        if let None = caddy.get_full_config() {
+        if caddy.get_full_config().is_none() {
            info!("Http config not available in opnsense config, installing package");
            config.install_package("os-caddy").await.map_err(|e| {
                ExecutorError::UnexpectedError(format!(
--- a/harmony/src/infra/opnsense/load_balancer.rs
+++ b/harmony/src/infra/opnsense/load_balancer.rs
@@ -121,10 +121,12 @@ pub(crate) fn haproxy_xml_config_to_harmony_loadbalancer(

            LoadBalancerService {
                backend_servers,
-                listening_port: frontend.bind.parse().expect(&format!(
-                    "HAProxy frontend address should be a valid SocketAddr, got {}",
-                    frontend.bind
-                )),
+                listening_port: frontend.bind.parse().unwrap_or_else(|_| {
+                    panic!(
+                        "HAProxy frontend address should be a valid SocketAddr, got {}",
+                        frontend.bind
+                    )
+                }),
                health_check,
            }
        })
@@ -167,28 +169,28 @@ pub(crate) fn get_health_check_for_backend(
        None => return None,
    };

-    let haproxy_health_check = match haproxy
+    let haproxy_health_check = haproxy
        .healthchecks
        .healthchecks
        .iter()
-        .find(|h| &h.uuid == health_check_uuid)
-    {
-        Some(health_check) => health_check,
-        None => return None,
-    };
+        .find(|h| &h.uuid == health_check_uuid)?;

    let binding = haproxy_health_check.health_check_type.to_uppercase();
    let uppercase = binding.as_str();
    match uppercase {
        "TCP" => {
            if let Some(checkport) = haproxy_health_check.checkport.content.as_ref() {
-                if checkport.len() > 0 {
-                    return Some(HealthCheck::TCP(Some(checkport.parse().expect(&format!(
-                        "HAProxy check port should be a valid port number, got {checkport}"
-                    )))));
+                if !checkport.is_empty() {
+                    return Some(HealthCheck::TCP(Some(checkport.parse().unwrap_or_else(
+                        |_| {
+                            panic!(
+                                "HAProxy check port should be a valid port number, got {checkport}"
+                            )
+                        },
+                    ))));
                }
            }
-            return Some(HealthCheck::TCP(None));
+            Some(HealthCheck::TCP(None))
        }
        "HTTP" => {
            let path: String = haproxy_health_check
@@ -355,16 +357,13 @@ mod tests {

        // Create an HAProxy instance with servers
        let mut haproxy = HAProxy::default();
-        let mut server = HAProxyServer::default();
-        server.uuid = "server1".to_string();
-        server.address = "192.168.1.1".to_string();
-        server.port = 80;
-
+        let server = HAProxyServer {
+            uuid: "server1".to_string(),
+            address: "192.168.1.1".to_string(),
+            port: 80,
+            ..Default::default()
+        };
        haproxy.servers.servers.push(server);
-        let mut server = HAProxyServer::default();
-        server.uuid = "server3".to_string();
-        server.address = "192.168.1.3".to_string();
-        server.port = 8080;

        // Call the function
        let result = get_servers_for_backend(&backend, &haproxy);
@@ -384,10 +383,12 @@ mod tests {
        let backend = HAProxyBackend::default();
        // Create an HAProxy instance with servers
        let mut haproxy = HAProxy::default();
-        let mut server = HAProxyServer::default();
-        server.uuid = "server1".to_string();
-        server.address = "192.168.1.1".to_string();
-        server.port = 80;
+        let server = HAProxyServer {
+            uuid: "server1".to_string(),
+            address: "192.168.1.1".to_string(),
+            port: 80,
+            ..Default::default()
+        };
        haproxy.servers.servers.push(server);
        // Call the function
        let result = get_servers_for_backend(&backend, &haproxy);
@@ -402,10 +403,12 @@ mod tests {
        backend.linked_servers.content = Some("server4,server5".to_string());
        // Create an HAProxy instance with servers
        let mut haproxy = HAProxy::default();
-        let mut server = HAProxyServer::default();
-        server.uuid = "server1".to_string();
-        server.address = "192.168.1.1".to_string();
-        server.port = 80;
+        let server = HAProxyServer {
+            uuid: "server1".to_string(),
+            address: "192.168.1.1".to_string(),
+            port: 80,
+            ..Default::default()
+        };
        haproxy.servers.servers.push(server);
        // Call the function
        let result = get_servers_for_backend(&backend, &haproxy);
@@ -416,20 +419,28 @@ mod tests {
    #[test]
    fn test_get_servers_for_backend_multiple_linked_servers() {
        // Create a backend with multiple linked servers
+        #[allow(clippy::field_reassign_with_default)]
        let mut backend = HAProxyBackend::default();
        backend.linked_servers.content = Some("server1,server2".to_string());
+        //
        // Create an HAProxy instance with matching servers
        let mut haproxy = HAProxy::default();
-        let mut server = HAProxyServer::default();
-        server.uuid = "server1".to_string();
-        server.address = "some-hostname.test.mcd".to_string();
-        server.port = 80;
+        let server = HAProxyServer {
+            uuid: "server1".to_string(),
+            address: "some-hostname.test.mcd".to_string(),
+            port: 80,
+            ..Default::default()
+        };
        haproxy.servers.servers.push(server);
-        let mut server = HAProxyServer::default();
-        server.uuid = "server2".to_string();
-        server.address = "192.168.1.2".to_string();
-        server.port = 8080;
+
+        let server = HAProxyServer {
+            uuid: "server2".to_string(),
+            address: "192.168.1.2".to_string(),
+            port: 8080,
+            ..Default::default()
+        };
        haproxy.servers.servers.push(server);
+
        // Call the function
        let result = get_servers_for_backend(&backend, &haproxy);
        // Check the result
--- a/harmony/src/infra/opnsense/mod.rs
+++ b/harmony/src/infra/opnsense/mod.rs
@@ -7,18 +7,13 @@ mod management;
 mod tftp;
 use std::sync::Arc;

-use async_trait::async_trait;
 pub use management::*;
 use opnsense_config_xml::Host;
 use tokio::sync::RwLock;

 use crate::{
    executors::ExecutorError,
-    interpret::InterpretError,
-    inventory::Inventory,
-    modules::opnsense::OPNSenseLaunchUpgrade,
-    score::Score,
-    topology::{IpAddress, LogicalHost, Topology, upgradeable::Upgradeable},
+    topology::{IpAddress, LogicalHost},
 };

 #[derive(Debug, Clone)]
@@ -54,17 +49,3 @@ impl OPNSenseFirewall {
            .map_err(|e| ExecutorError::UnexpectedError(e.to_string()))
    }
 }
-
-#[async_trait]
-impl<T: Topology> Upgradeable<T> for OPNSenseFirewall {
-    async fn upgrade(&self, inventory: &Inventory, topology: &T) -> Result<(), InterpretError> {
-        OPNSenseLaunchUpgrade {
-            opnsense: self.get_opnsense_config(),
-        }
-        .create_interpret()
-        .execute(inventory, topology)
-        .await?;
-
-        Ok(())
-    }
-}
--- a/harmony/src/infra/opnsense/tftp.rs
+++ b/harmony/src/infra/opnsense/tftp.rs
@@ -58,7 +58,7 @@ impl TftpServer for OPNSenseFirewall {
    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
        let mut config = self.opnsense_config.write().await;
        let tftp = config.tftp();
-        if let None = tftp.get_full_config() {
+        if tftp.get_full_config().is_none() {
            info!("Tftp config not available in opnsense config, installing package");
            config.install_package("os-tftp").await.map_err(|e| {
                ExecutorError::UnexpectedError(format!(
--- a/harmony/src/modules/application/feature.rs
+++ b/harmony/src/modules/application/feature.rs
@@ -13,7 +13,7 @@ pub trait ApplicationFeature<T: Topology>:
    fn name(&self) -> String;
 }

-trait ApplicationFeatureClone<T: Topology> {
+pub trait ApplicationFeatureClone<T: Topology> {
    fn clone_box(&self) -> Box<dyn ApplicationFeature<T>>;
 }

@@ -27,7 +27,7 @@ where
 }

 impl<T: Topology> Serialize for Box<dyn ApplicationFeature<T>> {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
--- a/harmony/src/modules/application/features/argo_types.rs
+++ b/harmony/src/modules/application/features/argo_types.rs
@@ -184,12 +184,11 @@ impl ArgoApplication {
    pub fn to_yaml(&self) -> serde_yaml::Value {
        let name = &self.name;
        let namespace = if let Some(ns) = self.namespace.as_ref() {
-            &ns
+            ns
        } else {
            "argocd"
        };
        let project = &self.project;
-        let source = &self.source;

        let yaml_str = format!(
            r#"
@@ -228,7 +227,7 @@ spec:
            serde_yaml::to_value(&self.source).expect("couldn't serialize source to value");
        let sync_policy = serde_yaml::to_value(&self.sync_policy)
            .expect("couldn't serialize sync_policy to value");
-        let revision_history_limit = serde_yaml::to_value(&self.revision_history_limit)
+        let revision_history_limit = serde_yaml::to_value(self.revision_history_limit)
            .expect("couldn't serialize revision_history_limit to value");

        spec.insert(
--- a/harmony/src/modules/application/features/continuous_delivery.rs
+++ b/harmony/src/modules/application/features/continuous_delivery.rs
@@ -1,16 +1,16 @@
 use std::{io::Write, process::Command, sync::Arc};

 use async_trait::async_trait;
-use log::{error, info};
+use log::info;
 use serde_yaml::Value;
 use tempfile::NamedTempFile;

 use crate::{
-    config::Config,
+    config::HARMONY_DATA_DIR,
    data::Version,
    inventory::Inventory,
    modules::application::{
-        Application, ApplicationFeature, HelmPackage, OCICompliant,
+        ApplicationFeature, HelmPackage, OCICompliant,
        features::{ArgoApplication, ArgoHelmScore},
    },
    score::Score,
@@ -56,14 +56,9 @@ impl<A: OCICompliant + HelmPackage> ContinuousDelivery<A> {
        chart_url: String,
        image_name: String,
    ) -> Result<(), String> {
-        let config = Config::load().expect("couldn't load config");
-
-        error!(
-            "FIXME This works only with local k3d installations, which is fine only for current demo purposes. We assume usage of K8sAnywhereTopology"
-        );
-
-        error!("TODO hardcoded k3d bin path is wrong");
-        let k3d_bin_path = config.data_dir.join("k3d").join("k3d");
+        // TODO: This works only with local k3d installations, which is fine only for current demo purposes. We assume usage of K8sAnywhereTopology"
+        // https://git.nationtech.io/NationTech/harmony/issues/106
+        let k3d_bin_path = (*HARMONY_DATA_DIR).join("k3d").join("k3d");
        // --- 1. Import the container image into the k3d cluster ---
        info!(
            "Importing image '{}' into k3d cluster 'harmony'",
@@ -147,25 +142,18 @@ impl<
    async fn ensure_installed(&self, topology: &T) -> Result<(), String> {
        let image = self.application.image_name();

-        // TODO
-        error!(
-            "TODO reverse helm chart packaging and docker image build. I put helm package first for faster iterations"
-        );
-
        // TODO Write CI/CD workflow files
        // we can autotedect the CI type using the remote url (default to github action for github
        // url, etc..)
        // Or ask for it when unknown

        let helm_chart = self.application.build_push_helm_package(&image).await?;
-        info!("Pushed new helm chart {helm_chart}");

-        error!("TODO Make building image configurable/skippable");
+        // TODO: Make building image configurable/skippable if image already exists (prompt)")
+        // https://git.nationtech.io/NationTech/harmony/issues/104
        let image = self.application.build_push_oci_image().await?;
-        info!("Pushed new docker image {image}");

-        info!("Installing ContinuousDelivery feature");
-        // TODO this is a temporary hack for demo purposes, the deployment target should be driven
+        // TODO: this is a temporary hack for demo purposes, the deployment target should be driven
        // by the topology only and we should not have to know how to perform tasks like this for
        // which the topology should be responsible.
        //
@@ -178,17 +166,20 @@ impl<
        // access it. This forces every Topology to understand the concept of targets though... So
        // instead I'll create a new Capability which is MultiTargetTopology and we'll see how it
        // goes. It still does not feel right though.
+        //
+        // https://git.nationtech.io/NationTech/harmony/issues/106
        match topology.current_target() {
            DeploymentTarget::LocalDev => {
+                info!("Deploying {} locally...", self.application.name());
                self.deploy_to_local_k3d(self.application.name(), helm_chart, image)
                    .await?;
            }
            target => {
-                info!("Deploying to target {target:?}");
+                info!("Deploying {} to target {target:?}", self.application.name());
                let score = ArgoHelmScore {
-                    namespace: "harmonydemo-staging".to_string(),
-                    openshift: false,
-                    domain: "argo.harmonydemo.apps.st.mcd".to_string(),
+                    namespace: "harmony-example-rust-webapp".to_string(),
+                    openshift: true,
+                    domain: "argo.harmonydemo.apps.ncd0.harmony.mcd".to_string(),
                    argo_apps: vec![ArgoApplication::from(CDApplicationConfig {
                        // helm pull oci://hub.nationtech.io/harmony/harmony-example-rust-webapp-chart --version 0.1.0
                        version: Version::from("0.1.0").unwrap(),
@@ -196,12 +187,11 @@ impl<
                        helm_chart_name: "harmony-example-rust-webapp-chart".to_string(),
                        values_overrides: None,
                        name: "harmony-demo-rust-webapp".to_string(),
-                        namespace: "harmonydemo-staging".to_string(),
+                        namespace: "harmony-example-rust-webapp".to_string(),
                    })],
                };
                score
-                    .create_interpret()
-                    .execute(&Inventory::empty(), topology)
+                    .interpret(&Inventory::empty(), topology)
                    .await
                    .unwrap();
            }
--- a/harmony/src/modules/application/features/helm_argocd_score.rs
+++ b/harmony/src/modules/application/features/helm_argocd_score.rs
@@ -1,5 +1,4 @@
 use async_trait::async_trait;
-use log::error;
 use non_blank_string_rs::NonBlankString;
 use serde::Serialize;
 use std::str::FromStr;
@@ -50,20 +49,21 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for ArgoInterpret {
        inventory: &Inventory,
        topology: &T,
    ) -> Result<Outcome, InterpretError> {
-        error!("Uncomment below, only disabled for debugging");
-        self.score
-            .create_interpret()
-            .execute(inventory, topology)
-            .await?;
+        self.score.interpret(inventory, topology).await?;

        let k8s_client = topology.k8s_client().await?;
        k8s_client
            .apply_yaml_many(&self.argo_apps.iter().map(|a| a.to_yaml()).collect(), None)
            .await
            .unwrap();
+
        Ok(Outcome::success(format!(
-            "Successfully installed ArgoCD and {} Applications",
-            self.argo_apps.len()
+            "ArgoCD installed with {} {}",
+            self.argo_apps.len(),
+            match self.argo_apps.len() {
+                1 => "application",
+                _ => "applications",
+            }
        )))
    }

@@ -986,7 +986,7 @@ commitServer:
    );

    HelmChartScore {
-        namespace: Some(NonBlankString::from_str(&namespace).unwrap()),
+        namespace: Some(NonBlankString::from_str(namespace).unwrap()),
        release_name: NonBlankString::from_str("argo-cd").unwrap(),
        chart_name: NonBlankString::from_str("argo/argo-cd").unwrap(),
        chart_version: Some(NonBlankString::from_str("8.1.2").unwrap()),
--- a/harmony/src/modules/application/features/monitoring.rs
+++ b/harmony/src/modules/application/features/monitoring.rs
@@ -1,51 +1,67 @@
 use std::sync::Arc;

-use async_trait::async_trait;
-use base64::{Engine as _, engine::general_purpose};
-use log::{debug, info};
+use crate::modules::application::{Application, ApplicationFeature};
+use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
+use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus;

+use crate::topology::MultiTargetTopology;
 use crate::{
    inventory::Inventory,
-    modules::{
-        application::{ApplicationFeature, OCICompliant},
-        monitoring::{
-            alert_channel::webhook_receiver::WebhookReceiver,
-            kube_prometheus::{
-                helm_prometheus_alert_score::HelmPrometheusAlertingScore,
-                types::{NamespaceSelector, ServiceMonitor},
-            },
-            ntfy::ntfy::NtfyScore,
-        },
+    modules::monitoring::{
+        alert_channel::webhook_receiver::WebhookReceiver, ntfy::ntfy::NtfyScore,
    },
    score::Score,
    topology::{HelmCommand, K8sclient, Topology, Url, tenant::TenantManager},
 };
+use crate::{
+    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
+    topology::oberservability::monitoring::AlertReceiver,
+};
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose};
+use log::{debug, info};

 #[derive(Debug, Clone)]
 pub struct Monitoring {
-    pub application: Arc<dyn OCICompliant>,
+    pub application: Arc<dyn Application>,
+    pub alert_receiver: Vec<Box<dyn AlertReceiver<CRDPrometheus>>>,
 }

 #[async_trait]
-impl<T: Topology + HelmCommand + K8sclient + 'static + TenantManager> ApplicationFeature<T>
-    for Monitoring
+impl<
+    T: Topology
+        + HelmCommand
+        + 'static
+        + TenantManager
+        + K8sclient
+        + MultiTargetTopology
+        + std::fmt::Debug
+        + PrometheusApplicationMonitoring<CRDPrometheus>,
+> ApplicationFeature<T> for Monitoring
 {
    async fn ensure_installed(&self, topology: &T) -> Result<(), String> {
        info!("Ensuring monitoring is available for application");
-
-        let ntfy = NtfyScore {
-            // namespace: topology
-            //     .get_tenant_config()
-            //     .await
-            //     .expect("couldn't get tenant config")
-            //     .name,
-            namespace: self.application.name(),
-            host: "localhost".to_string(),
-        };
-        ntfy.create_interpret()
-            .execute(&Inventory::empty(), topology)
+        let namespace = topology
+            .get_tenant_config()
            .await
-            .expect("couldn't create interpret for ntfy");
+            .map(|ns| ns.name.clone())
+            .unwrap_or_else(|| self.application.name());
+
+        let mut alerting_score = ApplicationMonitoringScore {
+            sender: CRDPrometheus {
+                namespace: namespace.clone(),
+                client: topology.k8s_client().await.unwrap(),
+            },
+            application: self.application.clone(),
+            receivers: self.alert_receiver.clone(),
+        };
+        let ntfy = NtfyScore {
+            namespace: namespace.clone(),
+            host: "ntfy.harmonydemo.apps.ncd0.harmony.mcd".to_string(),
+        };
+        ntfy.interpret(&Inventory::empty(), topology)
+            .await
+            .map_err(|e| e.to_string())?;

        let ntfy_default_auth_username = "harmony";
        let ntfy_default_auth_password = "harmony";
@@ -70,7 +86,7 @@ impl<T: Topology + HelmCommand + K8sclient + 'static + TenantManager> Applicatio
                url::Url::parse(
                    format!(
                        "http://ntfy.{}.svc.cluster.local/rust-web-app?auth={ntfy_default_auth_param}",
-                        self.application.name()
+                        namespace.clone()
                    )
                    .as_str(),
                )
@@ -78,31 +94,11 @@ impl<T: Topology + HelmCommand + K8sclient + 'static + TenantManager> Applicatio
            ),
        };

-        let mut service_monitor = ServiceMonitor::default();
-        service_monitor.namespace_selector = Some(NamespaceSelector {
-            any: true,
-            match_names: vec![],
-        });
-
-        service_monitor.name = "rust-webapp".to_string();
-
-        // let alerting_score = ApplicationPrometheusMonitoringScore {
-        //     receivers: vec![Box::new(ntfy_receiver)],
-        //     rules: vec![],
-        //     service_monitors: vec![service_monitor],
-        // };
-
-        let alerting_score = HelmPrometheusAlertingScore {
-            receivers: vec![Box::new(ntfy_receiver)],
-            rules: vec![],
-            service_monitors: vec![service_monitor],
-        };
-
+        alerting_score.receivers.push(Box::new(ntfy_receiver));
        alerting_score
-            .create_interpret()
-            .execute(&Inventory::empty(), topology)
+            .interpret(&Inventory::empty(), topology)
            .await
-            .unwrap();
+            .map_err(|e| e.to_string())?;
        Ok(())
    }
    fn name(&self) -> String {
--- a/harmony/src/modules/application/mod.rs
+++ b/harmony/src/modules/application/mod.rs
@@ -5,19 +5,28 @@ mod rust;
 use std::sync::Arc;

 pub use feature::*;
-use log::info;
+use log::debug;
 pub use oci::*;
 pub use rust::*;

 use async_trait::async_trait;
+use serde::Serialize;

 use crate::{
    data::{Id, Version},
+    instrumentation::{self, HarmonyEvent},
    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
    inventory::Inventory,
    topology::Topology,
 };

+#[derive(Clone, Debug)]
+pub enum ApplicationFeatureStatus {
+    Installing,
+    Installed,
+    Failed { details: String },
+}
+
 pub trait Application: std::fmt::Debug + Send + Sync {
    fn name(&self) -> String;
 }
@@ -36,7 +45,7 @@ impl<A: Application, T: Topology + std::fmt::Debug> Interpret<T> for Application
        topology: &T,
    ) -> Result<Outcome, InterpretError> {
        let app_name = self.application.name();
-        info!(
+        debug!(
            "Preparing {} features [{}] for application {app_name}",
            self.features.len(),
            self.features
@@ -46,20 +55,41 @@ impl<A: Application, T: Topology + std::fmt::Debug> Interpret<T> for Application
                .join(", ")
        );
        for feature in self.features.iter() {
-            info!(
-                "Installing feature {} for application {app_name}",
-                feature.name()
-            );
+            instrumentation::instrument(HarmonyEvent::ApplicationFeatureStateChanged {
+                topology: topology.name().into(),
+                application: self.application.name(),
+                feature: feature.name(),
+                status: ApplicationFeatureStatus::Installing,
+            })
+            .unwrap();
+
            let _ = match feature.ensure_installed(topology).await {
-                Ok(()) => (),
+                Ok(()) => {
+                    instrumentation::instrument(HarmonyEvent::ApplicationFeatureStateChanged {
+                        topology: topology.name().into(),
+                        application: self.application.name(),
+                        feature: feature.name(),
+                        status: ApplicationFeatureStatus::Installed,
+                    })
+                    .unwrap();
+                }
                Err(msg) => {
+                    instrumentation::instrument(HarmonyEvent::ApplicationFeatureStateChanged {
+                        topology: topology.name().into(),
+                        application: self.application.name(),
+                        feature: feature.name(),
+                        status: ApplicationFeatureStatus::Failed {
+                            details: msg.clone(),
+                        },
+                    })
+                    .unwrap();
                    return Err(InterpretError::new(format!(
                        "Application Interpret failed to install feature : {msg}"
                    )));
                }
            };
        }
-        Ok(Outcome::success("successfully created app".to_string()))
+        Ok(Outcome::success("Application created".to_string()))
    }

    fn get_name(&self) -> InterpretName {
@@ -78,3 +108,12 @@ impl<A: Application, T: Topology + std::fmt::Debug> Interpret<T> for Application
        todo!()
    }
 }
+
+impl Serialize for dyn Application {
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        todo!()
+    }
+}
--- a/harmony/src/modules/application/rust.rs
+++ b/harmony/src/modules/application/rust.rs
@@ -1,5 +1,5 @@
 use std::fs;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::process;
 use std::sync::Arc;

@@ -10,11 +10,11 @@ use dockerfile_builder::Dockerfile;
 use dockerfile_builder::instruction::{CMD, COPY, ENV, EXPOSE, FROM, RUN, USER, WORKDIR};
 use dockerfile_builder::instruction_builder::CopyBuilder;
 use futures_util::StreamExt;
-use log::{debug, error, info};
+use log::{debug, info, log_enabled};
 use serde::Serialize;
 use tar::Archive;

-use crate::config::Config;
+use crate::config::{REGISTRY_PROJECT, REGISTRY_URL};
 use crate::{
    score::Score,
    topology::{Topology, Url},
@@ -46,7 +46,7 @@ where
    }

    fn name(&self) -> String {
-        format!("Application: {}", self.application.name())
+        format!("{} [ApplicationScore]", self.application.name())
    }
 }

@@ -109,24 +109,20 @@ impl OCICompliant for RustWebapp {
        // It's async to match the trait definition, though the underlying docker commands are blocking.
        info!("Starting OCI image build and push for '{}'", self.name);

-        // 1. Build the local image by calling the synchronous helper function.
-        let local_image_name = self.local_image_name();
-        self.build_docker_image(&local_image_name)
+        // 1. Build the image by calling the synchronous helper function.
+        let image_tag = self.image_name();
+        self.build_docker_image(&image_tag)
            .await
            .map_err(|e| format!("Failed to build Docker image: {}", e))?;
-        info!(
-            "Successfully built local Docker image: {}",
-            local_image_name
-        );
+        info!("Successfully built Docker image: {}", image_tag);

-        let remote_image_name = self.image_name();
        // 2. Push the image to the registry.
-        self.push_docker_image(&local_image_name, &remote_image_name)
+        self.push_docker_image(&image_tag)
            .await
            .map_err(|e| format!("Failed to push Docker image: {}", e))?;
-        info!("Successfully pushed Docker image to: {}", remote_image_name);
+        info!("Successfully pushed Docker image to: {}", image_tag);

-        Ok(remote_image_name)
+        Ok(image_tag)
    }

    fn local_image_name(&self) -> String {
@@ -134,12 +130,10 @@ impl OCICompliant for RustWebapp {
    }

    fn image_name(&self) -> String {
-        let config = Config::load().expect("couldn't load config");
-
        format!(
            "{}/{}/{}",
-            config.registry_url,
-            config.registry_project,
+            *REGISTRY_URL,
+            *REGISTRY_PROJECT,
            &self.local_image_name()
        )
    }
@@ -165,20 +159,22 @@ impl RustWebapp {
        &self,
        image_name: &str,
    ) -> Result<String, Box<dyn std::error::Error>> {
-        info!("Generating Dockerfile for '{}'", self.name);
+        debug!("Generating Dockerfile for '{}'", self.name);
        let _dockerfile_path = self.build_dockerfile()?;

        let docker = Docker::connect_with_socket_defaults().unwrap();

+        let quiet = !log_enabled!(log::Level::Debug);
+
        let build_image_options = bollard::query_parameters::BuildImageOptionsBuilder::default()
            .dockerfile("Dockerfile.harmony")
            .t(image_name)
-            .q(false)
+            .q(quiet)
            .version(bollard::query_parameters::BuilderVersion::BuilderV1)
            .platform("linux/x86_64");

        let mut temp_tar_builder = tar::Builder::new(Vec::new());
-        let _ = temp_tar_builder
+        temp_tar_builder
            .append_dir_all("", self.project_root.clone())
            .unwrap();
        let archive = temp_tar_builder
@@ -199,7 +195,7 @@ impl RustWebapp {
        );

        while let Some(msg) = image_build_stream.next().await {
-            println!("Message: {msg:?}");
+            debug!("Message: {msg:?}");
        }

        Ok(image_name.to_string())
@@ -208,23 +204,25 @@ impl RustWebapp {
    /// Tags and pushes a Docker image to the configured remote registry.
    async fn push_docker_image(
        &self,
-        image_name: &str,
-        full_tag: &str,
+        image_tag: &str,
    ) -> Result<String, Box<dyn std::error::Error>> {
-        info!("Pushing docker image {full_tag}");
+        debug!("Pushing docker image {image_tag}");

        let docker = Docker::connect_with_socket_defaults().unwrap();

        // let push_options = PushImageOptionsBuilder::new().tag(tag);

-        let mut push_image_stream =
-            docker.push_image(full_tag, Some(PushImageOptionsBuilder::new().build()), None);
+        let mut push_image_stream = docker.push_image(
+            image_tag,
+            Some(PushImageOptionsBuilder::new().build()),
+            None,
+        );

        while let Some(msg) = push_image_stream.next().await {
-            println!("Message: {msg:?}");
+            debug!("Message: {msg:?}");
        }

-        Ok(full_tag.to_string())
+        Ok(image_tag.to_string())
    }

    /// Checks the output of a process command for success.
@@ -290,9 +288,8 @@ impl RustWebapp {
                        .unwrap(),
                );
                // Copy the compiled binary from the builder stage.
-                error!(
-                    "FIXME Should not be using score name here, instead should use name from Cargo.toml"
-                );
+                // TODO: Should not be using score name here, instead should use name from Cargo.toml
+                // https://git.nationtech.io/NationTech/harmony/issues/105
                let binary_path_in_builder = format!("/app/target/release/{}", self.name);
                let binary_path_in_final = format!("/home/appuser/{}", self.name);
                dockerfile.push(
@@ -330,9 +327,8 @@ impl RustWebapp {
                ));

                // Copy only the compiled binary from the builder stage.
-                error!(
-                    "FIXME Should not be using score name here, instead should use name from Cargo.toml"
-                );
+                // TODO: Should not be using score name here, instead should use name from Cargo.toml
+                // https://git.nationtech.io/NationTech/harmony/issues/105
                let binary_path_in_builder = format!("/app/target/release/{}", self.name);
                let binary_path_in_final = format!("/usr/local/bin/{}", self.name);
                dockerfile.push(
@@ -532,12 +528,9 @@ spec:
    }

    /// Packages a Helm chart directory into a .tgz file.
-    fn package_helm_chart(
-        &self,
-        chart_dir: &PathBuf,
-    ) -> Result<PathBuf, Box<dyn std::error::Error>> {
+    fn package_helm_chart(&self, chart_dir: &Path) -> Result<PathBuf, Box<dyn std::error::Error>> {
        let chart_dirname = chart_dir.file_name().expect("Should find a chart dirname");
-        info!(
+        debug!(
            "Launching `helm package {}` cli with CWD {}",
            chart_dirname.to_string_lossy(),
            &self
@@ -548,14 +541,13 @@ spec:
        );
        let output = process::Command::new("helm")
            .args(["package", chart_dirname.to_str().unwrap()])
-            .current_dir(&self.project_root.join(".harmony_generated").join("helm")) // Run package from the parent dir
+            .current_dir(self.project_root.join(".harmony_generated").join("helm")) // Run package from the parent dir
            .output()?;

        self.check_output(&output, "Failed to package Helm chart")?;

        // Helm prints the path of the created chart to stdout.
        let tgz_name = String::from_utf8(output.stdout)?
-            .trim()
            .split_whitespace()
            .last()
            .unwrap_or_default()
@@ -575,16 +567,14 @@ spec:
    /// Pushes a packaged Helm chart to an OCI registry.
    fn push_helm_chart(
        &self,
-        packaged_chart_path: &PathBuf,
+        packaged_chart_path: &Path,
    ) -> Result<String, Box<dyn std::error::Error>> {
-        let config = Config::load().expect("couldn't load config");
-
        // The chart name is the file stem of the .tgz file
        let chart_file_name = packaged_chart_path.file_stem().unwrap().to_str().unwrap();
-        let oci_push_url = format!("oci://{}/{}", config.registry_url, config.registry_project);
+        let oci_push_url = format!("oci://{}/{}", *REGISTRY_URL, *REGISTRY_PROJECT);
        let oci_pull_url = format!("{oci_push_url}/{}-chart", self.name);

-        info!(
+        debug!(
            "Pushing Helm chart {} to {}",
            packaged_chart_path.to_string_lossy(),
            oci_push_url
--- a/harmony/src/modules/cert_manager/helm.rs
+++ b/harmony/src/modules/cert_manager/helm.rs
@@ -41,6 +41,6 @@ impl<T: Topology + HelmCommand> Score<T> for CertManagerHelmScore {
    }

    fn name(&self) -> String {
-        format!("CertManagerHelmScore")
+        "CertManagerHelmScore".to_string()
    }
 }
--- a/harmony/src/modules/dhcp.rs
+++ b/harmony/src/modules/dhcp.rs
@@ -111,7 +111,7 @@ impl DhcpInterpret {

        let boot_filename_outcome = match &self.score.boot_filename {
            Some(boot_filename) => {
-                dhcp_server.set_boot_filename(&boot_filename).await?;
+                dhcp_server.set_boot_filename(boot_filename).await?;
                Outcome::new(
                    InterpretStatus::SUCCESS,
                    format!("Dhcp Interpret Set boot filename to {boot_filename}"),
@@ -122,7 +122,7 @@ impl DhcpInterpret {

        let filename_outcome = match &self.score.filename {
            Some(filename) => {
-                dhcp_server.set_filename(&filename).await?;
+                dhcp_server.set_filename(filename).await?;
                Outcome::new(
                    InterpretStatus::SUCCESS,
                    format!("Dhcp Interpret Set filename to {filename}"),
@@ -133,7 +133,7 @@ impl DhcpInterpret {

        let filename64_outcome = match &self.score.filename64 {
            Some(filename64) => {
-                dhcp_server.set_filename64(&filename64).await?;
+                dhcp_server.set_filename64(filename64).await?;
                Outcome::new(
                    InterpretStatus::SUCCESS,
                    format!("Dhcp Interpret Set filename64 to {filename64}"),
@@ -144,7 +144,7 @@ impl DhcpInterpret {

        let filenameipxe_outcome = match &self.score.filenameipxe {
            Some(filenameipxe) => {
-                dhcp_server.set_filenameipxe(&filenameipxe).await?;
+                dhcp_server.set_filenameipxe(filenameipxe).await?;
                Outcome::new(
                    InterpretStatus::SUCCESS,
                    format!("Dhcp Interpret Set filenameipxe to {filenameipxe}"),
@@ -209,7 +209,7 @@ impl<T: DhcpServer> Interpret<T> for DhcpInterpret {

        Ok(Outcome::new(
            InterpretStatus::SUCCESS,
-            format!("Dhcp Interpret execution successful"),
+            "Dhcp Interpret execution successful".to_string(),
        ))
    }
 }
--- a/harmony/src/modules/dns.rs
+++ b/harmony/src/modules/dns.rs
@@ -112,7 +112,7 @@ impl<T: Topology + DnsServer> Interpret<T> for DnsInterpret {

        Ok(Outcome::new(
            InterpretStatus::SUCCESS,
-            format!("Dns Interpret execution successful"),
+            "Dns Interpret execution successful".to_string(),
        ))
    }
 }
--- a/harmony/src/modules/helm/chart.rs
+++ b/harmony/src/modules/helm/chart.rs
@@ -55,7 +55,7 @@ impl<T: Topology + HelmCommand> Score<T> for HelmChartScore {
    }

    fn name(&self) -> String {
-        format!("{} {} HelmChartScore", self.release_name, self.chart_name)
+        format!("{} [HelmChartScore]", self.release_name)
    }
 }

@@ -90,14 +90,10 @@ impl HelmChartInterpret {
        );

        match add_output.status.success() {
-            true => {
-                return Ok(());
-            }
-            false => {
-                return Err(InterpretError::new(format!(
-                    "Failed to add helm repository!\n{full_output}"
-                )));
-            }
+            true => Ok(()),
+            false => Err(InterpretError::new(format!(
+                "Failed to add helm repository!\n{full_output}"
+            ))),
        }
    }
 }
@@ -212,7 +208,7 @@ impl<T: Topology + HelmCommand> Interpret<T> for HelmChartInterpret {
        }

        let res = helm_executor.install_or_upgrade(
-            &ns,
+            ns,
            &self.score.release_name,
            &self.score.chart_name,
            self.score.chart_version.as_ref(),
@@ -229,24 +225,27 @@ impl<T: Topology + HelmCommand> Interpret<T> for HelmChartInterpret {
        match status {
            helm_wrapper_rs::HelmDeployStatus::Deployed => Ok(Outcome::new(
                InterpretStatus::SUCCESS,
-                "Helm Chart deployed".to_string(),
+                format!("Helm Chart {} deployed", self.score.release_name),
            )),
            helm_wrapper_rs::HelmDeployStatus::PendingInstall => Ok(Outcome::new(
                InterpretStatus::RUNNING,
-                "Helm Chart Pending install".to_string(),
+                format!("Helm Chart {} pending install...", self.score.release_name),
            )),
            helm_wrapper_rs::HelmDeployStatus::PendingUpgrade => Ok(Outcome::new(
                InterpretStatus::RUNNING,
-                "Helm Chart pending upgrade".to_string(),
-            )),
-            helm_wrapper_rs::HelmDeployStatus::Failed => Err(InterpretError::new(
-                "Failed to install helm chart".to_string(),
+                format!("Helm Chart {} pending upgrade...", self.score.release_name),
            )),
+            helm_wrapper_rs::HelmDeployStatus::Failed => Err(InterpretError::new(format!(
+                "Helm Chart {} installation failed",
+                self.score.release_name
+            ))),
        }
    }
+
    fn get_name(&self) -> InterpretName {
-        todo!()
+        InterpretName::HelmChart
    }
+
    fn get_version(&self) -> Version {
        todo!()
    }
--- a/harmony/src/modules/helm/command.rs
+++ b/harmony/src/modules/helm/command.rs
@@ -77,14 +77,11 @@ impl HelmCommandExecutor {
            )?;
        }

-        let out = match self.clone().run_command(
+        let out = self.clone().run_command(
            self.chart
                .clone()
                .helm_args(self.globals.chart_home.clone().unwrap()),
-        ) {
-            Ok(out) => out,
-            Err(e) => return Err(e),
-        };
+        )?;

        // TODO: don't use unwrap here
        let s = String::from_utf8(out.stdout).unwrap();
@@ -98,14 +95,11 @@ impl HelmCommandExecutor {
    }

    pub fn version(self) -> Result<String, std::io::Error> {
-        let out = match self.run_command(vec![
+        let out = self.run_command(vec![
            "version".to_string(),
            "-c".to_string(),
            "--short".to_string(),
-        ]) {
-            Ok(out) => out,
-            Err(e) => return Err(e),
-        };
+        ])?;

        // TODO: don't use unwrap
        Ok(String::from_utf8(out.stdout).unwrap())
@@ -129,15 +123,11 @@ impl HelmCommandExecutor {
            None => PathBuf::from(TempDir::new()?.path()),
        };

-        match self.chart.values_inline {
-            Some(yaml_str) => {
-                let tf: TempFile;
-                tf = temp_file::with_contents(yaml_str.as_bytes());
-                self.chart
-                    .additional_values_files
-                    .push(PathBuf::from(tf.path()));
-            }
-            None => (),
+        if let Some(yaml_str) = self.chart.values_inline {
+            let tf: TempFile = temp_file::with_contents(yaml_str.as_bytes());
+            self.chart
+                .additional_values_files
+                .push(PathBuf::from(tf.path()));
        };

        self.env.insert(
@@ -180,9 +170,9 @@ impl HelmChart {
        match self.repo {
            Some(r) => {
                if r.starts_with("oci://") {
-                    args.push(String::from(
+                    args.push(
                        r.trim_end_matches("/").to_string() + "/" + self.name.clone().as_str(),
-                    ));
+                    );
                } else {
                    args.push("--repo".to_string());
                    args.push(r.to_string());
@@ -193,12 +183,9 @@ impl HelmChart {
            None => args.push(self.name),
        };

-        match self.version {
-            Some(v) => {
-                args.push("--version".to_string());
-                args.push(v.to_string());
-            }
-            None => (),
+        if let Some(v) = self.version {
+            args.push("--version".to_string());
+            args.push(v.to_string());
        }

        args
@@ -362,7 +349,7 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for HelmChartInterpretV
    }

    fn get_name(&self) -> InterpretName {
-        todo!()
+        InterpretName::HelmCommand
    }
    fn get_version(&self) -> Version {
        todo!()
--- a/harmony/src/modules/k3d/install.rs
+++ b/harmony/src/modules/k3d/install.rs
@@ -1,11 +1,11 @@
 use std::path::PathBuf;

 use async_trait::async_trait;
-use log::info;
+use log::debug;
 use serde::Serialize;

 use crate::{
-    config::Config,
+    config::HARMONY_DATA_DIR,
    data::{Id, Version},
    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
    inventory::Inventory,
@@ -21,24 +21,22 @@ pub struct K3DInstallationScore {

 impl Default for K3DInstallationScore {
    fn default() -> Self {
-        let config = Config::load().expect("couldn't load config");
-
        Self {
-            installation_path: config.data_dir.join("k3d"),
+            installation_path: HARMONY_DATA_DIR.join("k3d"),
            cluster_name: "harmony".to_string(),
        }
    }
 }

 impl<T: Topology> Score<T> for K3DInstallationScore {
-    fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
        Box::new(K3dInstallationInterpret {
            score: self.clone(),
        })
    }

    fn name(&self) -> String {
-        todo!()
+        "K3dInstallationScore".into()
    }
 }

@@ -58,14 +56,15 @@ impl<T: Topology> Interpret<T> for K3dInstallationInterpret {
            self.score.installation_path.clone(),
            Some(self.score.cluster_name.clone()),
        );
+
        match k3d.ensure_installed().await {
            Ok(_client) => {
-                let msg = format!("k3d cluster {} is installed ", self.score.cluster_name);
-                info!("{msg}");
+                let msg = format!("k3d cluster '{}' installed ", self.score.cluster_name);
+                debug!("{msg}");
                Ok(Outcome::success(msg))
            }
            Err(msg) => Err(InterpretError::new(format!(
-                "K3dInstallationInterpret failed to ensure k3d is installed : {msg}"
+                "failed to ensure k3d is installed : {msg}"
            ))),
        }
    }
--- a/harmony/src/modules/k8s/resource.rs
+++ b/harmony/src/modules/k8s/resource.rs
@@ -89,7 +89,7 @@ where
        ))
    }
    fn get_name(&self) -> InterpretName {
-        todo!()
+        InterpretName::K8sResource
    }
    fn get_version(&self) -> Version {
        todo!()
--- a/harmony/src/modules/lamp.rs
+++ b/harmony/src/modules/lamp.rs
@@ -14,7 +14,7 @@ use async_trait::async_trait;
 use log::{debug, info};
 use serde::Serialize;

-use crate::config::Config as HarmonyConfig;
+use crate::config::{REGISTRY_PROJECT, REGISTRY_URL};
 use crate::modules::k8s::ingress::K8sIngressScore;
 use crate::topology::HelmCommand;
 use crate::{
@@ -128,13 +128,12 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for LAMPInterpret {

        info!("Deploying score {deployment_score:#?}");

-        deployment_score
-            .create_interpret()
-            .execute(inventory, topology)
-            .await?;
+        deployment_score.interpret(inventory, topology).await?;

        info!("LAMP deployment_score {deployment_score:?}");

+        let ingress_path = ingress_path!("/");
+
        let lamp_ingress = K8sIngressScore {
            name: fqdn!("lamp-ingress"),
            host: fqdn!("test"),
@@ -144,17 +143,14 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for LAMPInterpret {
                    .as_str()
            ),
            port: 8080,
-            path: Some(ingress_path!("/")),
+            path: Some(ingress_path),
            path_type: None,
            namespace: self
                .get_namespace()
                .map(|nbs| fqdn!(nbs.to_string().as_str())),
        };

-        lamp_ingress
-            .create_interpret()
-            .execute(inventory, topology)
-            .await?;
+        lamp_ingress.interpret(inventory, topology).await?;

        info!("LAMP lamp_ingress {lamp_ingress:?}");

@@ -164,7 +160,7 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for LAMPInterpret {
    }

    fn get_name(&self) -> InterpretName {
-        todo!()
+        InterpretName::Lamp
    }

    fn get_version(&self) -> Version {
@@ -213,7 +209,7 @@ impl LAMPInterpret {
            repository: None,
        };

-        score.create_interpret().execute(inventory, topology).await
+        score.interpret(inventory, topology).await
    }
    fn build_dockerfile(&self, score: &LAMPScore) -> Result<PathBuf, Box<dyn std::error::Error>> {
        let mut dockerfile = Dockerfile::new();
@@ -355,12 +351,7 @@ opcache.fast_shutdown=1
    }

    fn push_docker_image(&self, image_name: &str) -> Result<String, Box<dyn std::error::Error>> {
-        let config = HarmonyConfig::load().expect("couldn't load config");
-
-        let full_tag = format!(
-            "{}/{}/{}",
-            config.registry_url, config.registry_project, &image_name
-        );
+        let full_tag = format!("{}/{}/{}", *REGISTRY_URL, *REGISTRY_PROJECT, &image_name);
        let output = std::process::Command::new("docker")
            .args(["tag", image_name, &full_tag])
            .output()?;
--- a/harmony/src/modules/monitoring/alert_channel/discord_alert_channel.rs
+++ b/harmony/src/modules/monitoring/alert_channel/discord_alert_channel.rs
@@ -1,7 +1,16 @@
+use std::any::Any;
+use std::collections::BTreeMap;
+
 use async_trait::async_trait;
+use k8s_openapi::api::core::v1::Secret;
+use kube::api::ObjectMeta;
 use serde::Serialize;
+use serde_json::json;
 use serde_yaml::{Mapping, Value};

+use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::{
+    AlertmanagerConfig, AlertmanagerConfigSpec, CRDPrometheus,
+};
 use crate::{
    interpret::{InterpretError, Outcome},
    modules::monitoring::{
@@ -20,14 +29,98 @@ pub struct DiscordWebhook {
    pub url: Url,
 }

+#[async_trait]
+impl AlertReceiver<CRDPrometheus> for DiscordWebhook {
+    async fn install(&self, sender: &CRDPrometheus) -> Result<Outcome, InterpretError> {
+        let ns = sender.namespace.clone();
+        let secret_name = format!("{}-secret", self.name.clone());
+        let webhook_key = format!("{}", self.url.clone());
+
+        let mut string_data = BTreeMap::new();
+        string_data.insert("webhook-url".to_string(), webhook_key.clone());
+
+        let secret = Secret {
+            metadata: kube::core::ObjectMeta {
+                name: Some(secret_name.clone()),
+                ..Default::default()
+            },
+            string_data: Some(string_data),
+            type_: Some("Opaque".to_string()),
+            ..Default::default()
+        };
+
+        let _ = sender.client.apply(&secret, Some(&ns)).await;
+
+        let spec = AlertmanagerConfigSpec {
+            data: json!({
+                "route": {
+                    "receiver": self.name,
+                },
+                "receivers": [
+                    {
+                        "name": self.name,
+                        "discordConfigs": [
+                            {
+                            "apiURL": {
+                                "name": secret_name,
+                                "key":  "webhook-url",
+                            },
+                            "title": "{{ template \"discord.default.title\" . }}",
+                            "message": "{{ template \"discord.default.message\" . }}"
+                            }
+                        ]
+                    }
+                ]
+            }),
+        };
+
+        let alertmanager_configs = AlertmanagerConfig {
+            metadata: ObjectMeta {
+                name: Some(self.name.clone()),
+                labels: Some(std::collections::BTreeMap::from([(
+                    "alertmanagerConfig".to_string(),
+                    "enabled".to_string(),
+                )])),
+                namespace: Some(ns),
+                ..Default::default()
+            },
+            spec,
+        };
+
+        sender
+            .client
+            .apply(&alertmanager_configs, Some(&sender.namespace))
+            .await?;
+        Ok(Outcome::success(format!(
+            "installed crd-alertmanagerconfigs for {}",
+            self.name
+        )))
+    }
+    fn name(&self) -> String {
+        "discord-webhook".to_string()
+    }
+    fn clone_box(&self) -> Box<dyn AlertReceiver<CRDPrometheus>> {
+        Box::new(self.clone())
+    }
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+}
+
 #[async_trait]
 impl AlertReceiver<Prometheus> for DiscordWebhook {
    async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
        sender.install_receiver(self).await
    }
+    fn name(&self) -> String {
+        "discord-webhook".to_string()
+    }
    fn clone_box(&self) -> Box<dyn AlertReceiver<Prometheus>> {
        Box::new(self.clone())
    }
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
 }

 #[async_trait]
@@ -48,6 +141,12 @@ impl AlertReceiver<KubePrometheus> for DiscordWebhook {
    fn clone_box(&self) -> Box<dyn AlertReceiver<KubePrometheus>> {
        Box::new(self.clone())
    }
+    fn name(&self) -> String {
+        "discord-webhook".to_string()
+    }
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
 }

 #[async_trait]
--- a/harmony/src/modules/monitoring/alert_channel/webhook_receiver.rs
+++ b/harmony/src/modules/monitoring/alert_channel/webhook_receiver.rs
@@ -1,11 +1,19 @@
+use std::any::Any;
+
 use async_trait::async_trait;
+use kube::api::ObjectMeta;
+use log::debug;
 use serde::Serialize;
+use serde_json::json;
 use serde_yaml::{Mapping, Value};

 use crate::{
    interpret::{InterpretError, Outcome},
    modules::monitoring::{
        kube_prometheus::{
+            crd::crd_alertmanager_config::{
+                AlertmanagerConfig, AlertmanagerConfigSpec, CRDPrometheus,
+            },
            prometheus::{KubePrometheus, KubePrometheusReceiver},
            types::{AlertChannelConfig, AlertManagerChannelConfig},
        },
@@ -20,14 +28,81 @@ pub struct WebhookReceiver {
    pub url: Url,
 }

+#[async_trait]
+impl AlertReceiver<CRDPrometheus> for WebhookReceiver {
+    async fn install(&self, sender: &CRDPrometheus) -> Result<Outcome, InterpretError> {
+        let spec = AlertmanagerConfigSpec {
+            data: json!({
+                "route": {
+                    "receiver": self.name,
+                },
+                "receivers": [
+                    {
+                        "name": self.name,
+                        "webhookConfigs": [
+                            {
+                            "url": self.url,
+                            }
+                        ]
+                    }
+                ]
+            }),
+        };
+
+        let alertmanager_configs = AlertmanagerConfig {
+            metadata: ObjectMeta {
+                name: Some(self.name.clone()),
+                labels: Some(std::collections::BTreeMap::from([(
+                    "alertmanagerConfig".to_string(),
+                    "enabled".to_string(),
+                )])),
+                namespace: Some(sender.namespace.clone()),
+                ..Default::default()
+            },
+            spec,
+        };
+        debug!(
+            "alert manager configs: \n{:#?}",
+            alertmanager_configs.clone()
+        );
+
+        sender
+            .client
+            .apply(&alertmanager_configs, Some(&sender.namespace))
+            .await?;
+        Ok(Outcome::success(format!(
+            "installed crd-alertmanagerconfigs for {}",
+            self.name
+        )))
+    }
+
+    fn name(&self) -> String {
+        "webhook-receiver".to_string()
+    }
+
+    fn clone_box(&self) -> Box<dyn AlertReceiver<CRDPrometheus>> {
+        Box::new(self.clone())
+    }
+
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+}
+
 #[async_trait]
 impl AlertReceiver<Prometheus> for WebhookReceiver {
    async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
        sender.install_receiver(self).await
    }
+    fn name(&self) -> String {
+        "webhook-receiver".to_string()
+    }
    fn clone_box(&self) -> Box<dyn AlertReceiver<Prometheus>> {
        Box::new(self.clone())
    }
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
 }

 #[async_trait]
@@ -44,9 +119,15 @@ impl AlertReceiver<KubePrometheus> for WebhookReceiver {
    async fn install(&self, sender: &KubePrometheus) -> Result<Outcome, InterpretError> {
        sender.install_receiver(self).await
    }
+    fn name(&self) -> String {
+        "webhook-receiver".to_string()
+    }
    fn clone_box(&self) -> Box<dyn AlertReceiver<KubePrometheus>> {
        Box::new(self.clone())
    }
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
 }

 #[async_trait]
--- a/harmony/src/modules/monitoring/alert_rule/prometheus_alert_rule.rs
+++ b/harmony/src/modules/monitoring/alert_rule/prometheus_alert_rule.rs
@@ -18,7 +18,7 @@ use crate::{
 #[async_trait]
 impl AlertRule<KubePrometheus> for AlertManagerRuleGroup {
    async fn install(&self, sender: &KubePrometheus) -> Result<Outcome, InterpretError> {
-        sender.install_rule(&self).await
+        sender.install_rule(self).await
    }
    fn clone_box(&self) -> Box<dyn AlertRule<KubePrometheus>> {
        Box::new(self.clone())
@@ -28,7 +28,7 @@ impl AlertRule<KubePrometheus> for AlertManagerRuleGroup {
 #[async_trait]
 impl AlertRule<Prometheus> for AlertManagerRuleGroup {
    async fn install(&self, sender: &Prometheus) -> Result<Outcome, InterpretError> {
-        sender.install_rule(&self).await
+        sender.install_rule(self).await
    }
    fn clone_box(&self) -> Box<dyn AlertRule<Prometheus>> {
        Box::new(self.clone())
--- a/harmony/src/modules/monitoring/application_monitoring/application_monitoring_score.rs
+++ b/harmony/src/modules/monitoring/application_monitoring/application_monitoring_score.rs
@@ -0,0 +1,91 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use serde::Serialize;
+
+use crate::{
+    data::{Id, Version},
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    modules::{
+        application::Application,
+        monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus,
+        prometheus::prometheus::PrometheusApplicationMonitoring,
+    },
+    score::Score,
+    topology::{PreparationOutcome, Topology, oberservability::monitoring::AlertReceiver},
+};
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ApplicationMonitoringScore {
+    pub sender: CRDPrometheus,
+    pub application: Arc<dyn Application>,
+    pub receivers: Vec<Box<dyn AlertReceiver<CRDPrometheus>>>,
+}
+
+impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Score<T>
+    for ApplicationMonitoringScore
+{
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(ApplicationMonitoringInterpret {
+            score: self.clone(),
+        })
+    }
+
+    fn name(&self) -> String {
+        format!(
+            "{} monitoring [ApplicationMonitoringScore]",
+            self.application.name()
+        )
+    }
+}
+
+#[derive(Debug)]
+pub struct ApplicationMonitoringInterpret {
+    score: ApplicationMonitoringScore,
+}
+
+#[async_trait]
+impl<T: Topology + PrometheusApplicationMonitoring<CRDPrometheus>> Interpret<T>
+    for ApplicationMonitoringInterpret
+{
+    async fn execute(
+        &self,
+        inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        let result = topology
+            .install_prometheus(
+                &self.score.sender,
+                inventory,
+                Some(self.score.receivers.clone()),
+            )
+            .await;
+
+        match result {
+            Ok(outcome) => match outcome {
+                PreparationOutcome::Success { details: _ } => {
+                    Ok(Outcome::success("Prometheus installed".into()))
+                }
+                PreparationOutcome::Noop => Ok(Outcome::noop()),
+            },
+            Err(err) => Err(InterpretError::from(err)),
+        }
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::ApplicationMonitoring
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}
--- a/harmony/src/modules/monitoring/application_monitoring/k8s_application_monitoring_score.rs
+++ b/harmony/src/modules/monitoring/application_monitoring/k8s_application_monitoring_score.rs
@@ -1,44 +0,0 @@
-use std::sync::{Arc, Mutex};
-
-use serde::Serialize;
-
-use crate::{
-    modules::monitoring::{
-        kube_prometheus::types::ServiceMonitor,
-        prometheus::{prometheus::Prometheus, prometheus_config::PrometheusConfig},
-    },
-    score::Score,
-    topology::{
-        HelmCommand, Topology,
-        oberservability::monitoring::{AlertReceiver, AlertRule, AlertingInterpret},
-        tenant::TenantManager,
-    },
-};
-
-#[derive(Clone, Debug, Serialize)]
-pub struct ApplicationPrometheusMonitoringScore {
-    pub receivers: Vec<Box<dyn AlertReceiver<Prometheus>>>,
-    pub rules: Vec<Box<dyn AlertRule<Prometheus>>>,
-    pub service_monitors: Vec<ServiceMonitor>,
-}
-
-impl<T: Topology + HelmCommand + TenantManager> Score<T> for ApplicationPrometheusMonitoringScore {
-    fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
-        let mut prom_config = PrometheusConfig::new();
-        prom_config.alert_manager = true;
-
-        let config = Arc::new(Mutex::new(prom_config));
-        config
-            .try_lock()
-            .expect("couldn't lock config")
-            .additional_service_monitors = self.service_monitors.clone();
-        Box::new(AlertingInterpret {
-            sender: Prometheus::new(),
-            receivers: self.receivers.clone(),
-            rules: self.rules.clone(),
-        })
-    }
-    fn name(&self) -> String {
-        "ApplicationPrometheusMonitoringScore".to_string()
-    }
-}
--- a/harmony/src/modules/monitoring/application_monitoring/mod.rs
+++ b/harmony/src/modules/monitoring/application_monitoring/mod.rs
@@ -1 +1 @@
-pub mod k8s_application_monitoring_score;
+pub mod application_monitoring_score;
--- a/harmony/src/modules/monitoring/grafana/helm/helm_grafana.rs
+++ b/harmony/src/modules/monitoring/grafana/helm/helm_grafana.rs
@@ -4,15 +4,14 @@ use std::str::FromStr;
 use crate::modules::helm::chart::HelmChartScore;

 pub fn grafana_helm_chart_score(ns: &str) -> HelmChartScore {
-    let values = format!(
-        r#"
+    let values = r#"
 rbac:
  namespaced: true
 sidecar:
  dashboards:
    enabled: true
        "#
-    );
+    .to_string();

    HelmChartScore {
        namespace: Some(NonBlankString::from_str(ns).unwrap()),
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/crd_alertmanager_config.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/crd_alertmanager_config.rs
@@ -0,0 +1,50 @@
+use std::sync::Arc;
+
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use crate::topology::{
+    k8s::K8sClient,
+    oberservability::monitoring::{AlertReceiver, AlertSender},
+};
+
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "monitoring.coreos.com",
+    version = "v1alpha1",
+    kind = "AlertmanagerConfig",
+    plural = "alertmanagerconfigs",
+    namespaced
+)]
+pub struct AlertmanagerConfigSpec {
+    #[serde(flatten)]
+    pub data: serde_json::Value,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct CRDPrometheus {
+    pub namespace: String,
+    pub client: Arc<K8sClient>,
+}
+
+impl AlertSender for CRDPrometheus {
+    fn name(&self) -> String {
+        "CRDAlertManager".to_string()
+    }
+}
+
+impl Clone for Box<dyn AlertReceiver<CRDPrometheus>> {
+    fn clone(&self) -> Self {
+        self.clone_box()
+    }
+}
+
+impl Serialize for Box<dyn AlertReceiver<CRDPrometheus>> {
+    fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        todo!()
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/crd_alertmanagers.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/crd_alertmanagers.rs
@@ -0,0 +1,52 @@
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use super::crd_prometheuses::LabelSelector;
+
+/// Rust CRD for `Alertmanager` from Prometheus Operator
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "monitoring.coreos.com",
+    version = "v1",
+    kind = "Alertmanager",
+    plural = "alertmanagers",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct AlertmanagerSpec {
+    /// Number of replicas for HA
+    pub replicas: i32,
+
+    /// Selectors for AlertmanagerConfig CRDs
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub alertmanager_config_selector: Option<LabelSelector>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub alertmanager_config_namespace_selector: Option<LabelSelector>,
+
+    /// Optional pod template metadata (annotations, labels)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pod_metadata: Option<LabelSelector>,
+
+    /// Optional topology spread settings
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
+}
+
+impl Default for AlertmanagerSpec {
+    fn default() -> Self {
+        AlertmanagerSpec {
+            replicas: 1,
+
+            // Match all AlertmanagerConfigs in the same namespace
+            alertmanager_config_namespace_selector: None,
+
+            // Empty selector matches all AlertmanagerConfigs in that namespace
+            alertmanager_config_selector: Some(LabelSelector::default()),
+
+            pod_metadata: None,
+            version: None,
+        }
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/crd_default_rules.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/crd_default_rules.rs
@@ -0,0 +1,25 @@
+use crate::modules::prometheus::alerts::k8s::{
+    deployment::alert_deployment_unavailable,
+    pod::{alert_container_restarting, alert_pod_not_ready, pod_failed},
+    pvc::high_pvc_fill_rate_over_two_days,
+    service::alert_service_down,
+};
+
+use super::crd_prometheus_rules::Rule;
+
+pub fn build_default_application_rules() -> Vec<Rule> {
+    let pod_failed: Rule = pod_failed().into();
+    let container_restarting: Rule = alert_container_restarting().into();
+    let pod_not_ready: Rule = alert_pod_not_ready().into();
+    let service_down: Rule = alert_service_down().into();
+    let deployment_unavailable: Rule = alert_deployment_unavailable().into();
+    let high_pvc_fill_rate: Rule = high_pvc_fill_rate_over_two_days().into();
+    vec![
+        pod_failed,
+        container_restarting,
+        pod_not_ready,
+        service_down,
+        deployment_unavailable,
+        high_pvc_fill_rate,
+    ]
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/crd_grafana.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/crd_grafana.rs
@@ -0,0 +1,153 @@
+use std::collections::BTreeMap;
+
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use super::crd_prometheuses::LabelSelector;
+
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "grafana.integreatly.org",
+    version = "v1beta1",
+    kind = "Grafana",
+    plural = "grafanas",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaSpec {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub config: Option<GrafanaConfig>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub admin_user: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub admin_password: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ingress: Option<GrafanaIngress>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub persistence: Option<GrafanaPersistence>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resources: Option<ResourceRequirements>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaConfig {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub log: Option<GrafanaLogConfig>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub security: Option<GrafanaSecurityConfig>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaLogConfig {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mode: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub level: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaSecurityConfig {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub admin_user: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub admin_password: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaIngress {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub hosts: Option<Vec<String>>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaPersistence {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub storage_class_name: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub size: Option<String>,
+}
+
+// ------------------------------------------------------------------------------------------------
+
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "grafana.integreatly.org",
+    version = "v1beta1",
+    kind = "GrafanaDashboard",
+    plural = "grafanadashboards",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaDashboardSpec {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resync_period: Option<String>,
+
+    pub instance_selector: LabelSelector,
+
+    pub json: String,
+}
+
+// ------------------------------------------------------------------------------------------------
+
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "grafana.integreatly.org",
+    version = "v1beta1",
+    kind = "GrafanaDatasource",
+    plural = "grafanadatasources",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaDatasourceSpec {
+    pub instance_selector: LabelSelector,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub allow_cross_namespace_import: Option<bool>,
+
+    pub datasource: GrafanaDatasourceConfig,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct GrafanaDatasourceConfig {
+    pub access: String,
+    pub database: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub json_data: Option<BTreeMap<String, String>>,
+    pub name: String,
+    pub r#type: String,
+    pub url: String,
+}
+
+// ------------------------------------------------------------------------------------------------
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourceRequirements {
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub limits: BTreeMap<String, String>,
+
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub requests: BTreeMap<String, String>,
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/crd_prometheus_rules.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/crd_prometheus_rules.rs
@@ -0,0 +1,57 @@
+use std::collections::BTreeMap;
+
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::monitoring::alert_rule::prometheus_alert_rule::PrometheusAlertRule;
+
+#[derive(CustomResource, Debug, Serialize, Deserialize, Clone, JsonSchema)]
+#[kube(
+    group = "monitoring.coreos.com",
+    version = "v1",
+    kind = "PrometheusRule",
+    plural = "prometheusrules",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct PrometheusRuleSpec {
+    pub groups: Vec<RuleGroup>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+pub struct RuleGroup {
+    pub name: String,
+    pub rules: Vec<Rule>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct Rule {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub alert: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub expr: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub for_: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub labels: Option<std::collections::BTreeMap<String, String>>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub annotations: Option<std::collections::BTreeMap<String, String>>,
+}
+
+impl From<PrometheusAlertRule> for Rule {
+    fn from(value: PrometheusAlertRule) -> Self {
+        Rule {
+            alert: Some(value.alert),
+            expr: Some(value.expr),
+            for_: value.r#for,
+            labels: Some(value.labels.into_iter().collect::<BTreeMap<_, _>>()),
+            annotations: Some(value.annotations.into_iter().collect::<BTreeMap<_, _>>()),
+        }
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/crd_prometheuses.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/crd_prometheuses.rs
@@ -0,0 +1,118 @@
+use std::collections::BTreeMap;
+
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::monitoring::kube_prometheus::types::Operator;
+
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "monitoring.coreos.com",
+    version = "v1",
+    kind = "Prometheus",
+    plural = "prometheuses",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct PrometheusSpec {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub alerting: Option<PrometheusSpecAlerting>,
+
+    pub service_account_name: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub service_monitor_namespace_selector: Option<LabelSelector>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub service_monitor_selector: Option<LabelSelector>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub service_discovery_role: Option<String>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pod_monitor_selector: Option<LabelSelector>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rule_selector: Option<LabelSelector>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rule_namespace_selector: Option<LabelSelector>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct NamespaceSelector {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub match_names: Vec<String>,
+}
+
+/// Contains alerting configuration, specifically Alertmanager endpoints.
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, Default)]
+pub struct PrometheusSpecAlerting {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub alertmanagers: Option<Vec<AlertmanagerEndpoints>>,
+}
+
+/// Represents an Alertmanager endpoint configuration used by Prometheus.
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, Default)]
+pub struct AlertmanagerEndpoints {
+    /// Name of the Alertmanager Service.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+
+    /// Namespace of the Alertmanager Service.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub namespace: Option<String>,
+
+    /// Port to access on the Alertmanager Service (e.g. "web").
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub port: Option<String>,
+
+    /// Scheme to use for connecting (e.g. "http").
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scheme: Option<String>,
+    // Other fields like `tls_config`, `path_prefix`, etc., can be added if needed.
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct LabelSelector {
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub match_labels: BTreeMap<String, String>,
+
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub match_expressions: Vec<LabelSelectorRequirement>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct LabelSelectorRequirement {
+    pub key: String,
+    pub operator: Operator,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub values: Vec<String>,
+}
+
+impl Default for PrometheusSpec {
+    fn default() -> Self {
+        PrometheusSpec {
+            alerting: None,
+
+            service_account_name: "prometheus".into(),
+
+            // null means "only my namespace"
+            service_monitor_namespace_selector: None,
+
+            // empty selector means match all ServiceMonitors in that namespace
+            service_monitor_selector: Some(LabelSelector::default()),
+
+            service_discovery_role: Some("Endpoints".into()),
+
+            pod_monitor_selector: None,
+
+            rule_selector: None,
+
+            rule_namespace_selector: Some(LabelSelector::default()),
+        }
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/grafana_default_dashboard.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/grafana_default_dashboard.rs
@@ -0,0 +1,203 @@
+pub fn build_default_dashboard(namespace: &str) -> String {
+    let dashboard = format!(
+        r#"{{
+  "annotations": {{
+    "list": []
+  }},
+  "editable": true,
+  "gnetId": null,
+  "graphTooltip": 0,
+  "id": null,
+  "iteration": 171105,
+  "panels": [
+    {{
+      "datasource": "$datasource",
+      "fieldConfig": {{
+        "defaults": {{
+          "unit": "short"
+        }},
+        "overrides": []
+      }},
+      "gridPos": {{
+        "h": 6,
+        "w": 6,
+        "x": 0,
+        "y": 0
+      }},
+      "id": 1,
+      "options": {{
+        "reduceOptions": {{
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }}
+      }},
+      "pluginVersion": "9.0.0",
+      "targets": [
+        {{
+          "expr": "sum(kube_pod_status_phase{{namespace=\"{namespace}\",  phase=\"Running\"}})",
+          "legendFormat": "",
+          "refId": "A"
+        }}
+      ],
+      "title": "Pods in Namespace",
+      "type": "stat"
+    }},
+    {{
+      "datasource": "$datasource",
+      "fieldConfig": {{
+        "defaults": {{
+          "unit": "short"
+        }},
+        "overrides": []
+      }},
+      "gridPos": {{
+        "h": 6,
+        "w": 6,
+        "x": 6,
+        "y": 0
+      }},
+      "id": 2,
+      "options": {{
+        "reduceOptions": {{
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }}
+      }},
+      "pluginVersion": "9.0.0",
+      "targets": [
+        {{
+          "expr": "sum(kube_pod_status_phase{{phase=\"Failed\", namespace=\"{namespace}\"}})",
+          "legendFormat": "",
+          "refId": "A"
+        }}
+      ],
+      "title": "Pods in Failed State",
+      "type": "stat"
+    }},
+    {{
+      "datasource": "$datasource",
+      "fieldConfig": {{
+        "defaults": {{
+          "unit": "percentunit"
+        }},
+        "overrides": []
+      }},
+      "gridPos": {{
+        "h": 6,
+        "w": 12,
+        "x": 0,
+        "y": 6
+      }},
+      "id": 3,
+      "options": {{
+        "reduceOptions": {{
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }}
+      }},
+      "pluginVersion": "9.0.0",
+      "targets": [
+        {{
+          "expr": "sum(kube_deployment_status_replicas_available{{namespace=\"{namespace}\"}}) / sum(kube_deployment_spec_replicas{{namespace=\"{namespace}\"}})",
+          "legendFormat": "",
+          "refId": "A"
+        }}
+      ],
+      "title": "Deployment Health (Available / Desired)",
+      "type": "stat"
+    }},
+    {{
+      "datasource": "$datasource",
+      "fieldConfig": {{
+        "defaults": {{
+          "unit": "short"
+        }},
+        "overrides": []
+      }},
+      "gridPos": {{
+        "h": 6,
+        "w": 12,
+        "x": 0,
+        "y": 12
+      }},
+      "id": 4,
+      "options": {{
+        "reduceOptions": {{
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }}
+      }},
+      "pluginVersion": "9.0.0",
+      "targets": [
+        {{
+          "expr": "sum by(pod) (rate(kube_pod_container_status_restarts_total{{namespace=\"{namespace}\"}}[5m]))",
+          "legendFormat": "{{{{pod}}}}",
+          "refId": "A"
+        }}
+      ],
+      "title": "Container Restarts (per pod)",
+      "type": "timeseries"
+    }},
+    {{
+      "datasource": "$datasource",
+      "fieldConfig": {{
+        "defaults": {{
+          "unit": "short"
+        }},
+        "overrides": []
+      }},
+      "gridPos": {{
+        "h": 6,
+        "w": 12,
+        "x": 0,
+        "y": 18
+      }},
+      "id": 5,
+      "options": {{
+        "reduceOptions": {{
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        }}
+      }},
+      "pluginVersion": "9.0.0",
+      "targets": [
+        {{
+          "expr": "sum(ALERTS{{alertstate=\"firing\", namespace=\"{namespace}\"}}) or vector(0)",
+          "legendFormat": "",
+          "refId": "A"
+        }}
+      ],
+      "title": "Firing Alerts in Namespace",
+      "type": "stat"
+    }}
+  ],
+  "schemaVersion": 36,
+  "templating": {{
+    "list": [
+      {{
+        "name": "datasource",
+        "type": "datasource",
+        "pluginId": "prometheus",
+        "label": "Prometheus",
+        "query": "prometheus",
+        "refresh": 1,
+        "hide": 0,
+        "current": {{
+          "selected": true,
+          "text": "Prometheus",
+          "value": "Prometheus"
+        }}
+      }}
+    ]
+  }},
+  "title": "Tenant Namespace Overview",
+  "version": 1
+}}"#
+    );
+    dashboard
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/grafana_operator.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/grafana_operator.rs
@@ -0,0 +1,20 @@
+use std::str::FromStr;
+
+use non_blank_string_rs::NonBlankString;
+
+use crate::modules::helm::chart::HelmChartScore;
+
+pub fn grafana_operator_helm_chart_score(ns: String) -> HelmChartScore {
+    HelmChartScore {
+        namespace: Some(NonBlankString::from_str(&ns).unwrap()),
+        release_name: NonBlankString::from_str("grafana_operator").unwrap(),
+        chart_name: NonBlankString::from_str("oci://ghcr.io/grafana/helm-charts/grafana-operator")
+            .unwrap(),
+        chart_version: None,
+        values_overrides: None,
+        values_yaml: None,
+        create_namespace: true,
+        install_only: true,
+        repository: None,
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/mod.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/mod.rs
@@ -0,0 +1,11 @@
+pub mod crd_alertmanager_config;
+pub mod crd_alertmanagers;
+pub mod crd_default_rules;
+pub mod crd_grafana;
+pub mod crd_prometheus_rules;
+pub mod crd_prometheuses;
+pub mod grafana_default_dashboard;
+pub mod grafana_operator;
+pub mod prometheus_operator;
+pub mod role;
+pub mod service_monitor;
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/prometheus_operator.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/prometheus_operator.rs
@@ -0,0 +1,22 @@
+use std::str::FromStr;
+
+use non_blank_string_rs::NonBlankString;
+
+use crate::modules::helm::chart::HelmChartScore;
+
+pub fn prometheus_operator_helm_chart_score(ns: String) -> HelmChartScore {
+    HelmChartScore {
+        namespace: Some(NonBlankString::from_str(&ns).unwrap()),
+        release_name: NonBlankString::from_str("prometheus-operator").unwrap(),
+        chart_name: NonBlankString::from_str(
+            "oci://hub.nationtech.io/harmony/nt-prometheus-operator",
+        )
+        .unwrap(),
+        chart_version: None,
+        values_overrides: None,
+        values_yaml: None,
+        create_namespace: true,
+        install_only: true,
+        repository: None,
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/role.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/role.rs
@@ -0,0 +1,62 @@
+use k8s_openapi::api::{
+    core::v1::ServiceAccount,
+    rbac::v1::{PolicyRule, Role, RoleBinding, RoleRef, Subject},
+};
+use kube::api::ObjectMeta;
+
+pub fn build_prom_role(role_name: String, namespace: String) -> Role {
+    Role {
+        metadata: ObjectMeta {
+            name: Some(role_name),
+            namespace: Some(namespace),
+            ..Default::default()
+        },
+        rules: Some(vec![PolicyRule {
+            api_groups: Some(vec!["".into()]), // core API group
+            resources: Some(vec!["services".into(), "endpoints".into(), "pods".into()]),
+            verbs: vec!["get".into(), "list".into(), "watch".into()],
+            ..Default::default()
+        }]),
+    }
+}
+
+pub fn build_prom_rolebinding(
+    role_name: String,
+    namespace: String,
+    service_account_name: String,
+) -> RoleBinding {
+    RoleBinding {
+        metadata: ObjectMeta {
+            name: Some(format!("{}-rolebinding", role_name)),
+            namespace: Some(namespace.clone()),
+            ..Default::default()
+        },
+        role_ref: RoleRef {
+            api_group: "rbac.authorization.k8s.io".into(),
+            kind: "Role".into(),
+            name: role_name,
+        },
+        subjects: Some(vec![Subject {
+            kind: "ServiceAccount".into(),
+            name: service_account_name,
+            namespace: Some(namespace.clone()),
+            ..Default::default()
+        }]),
+    }
+}
+
+pub fn build_prom_service_account(
+    service_account_name: String,
+    namespace: String,
+) -> ServiceAccount {
+    ServiceAccount {
+        automount_service_account_token: None,
+        image_pull_secrets: None,
+        metadata: ObjectMeta {
+            name: Some(service_account_name),
+            namespace: Some(namespace),
+            ..Default::default()
+        },
+        secrets: None,
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/crd/service_monitor.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/crd/service_monitor.rs
@@ -0,0 +1,87 @@
+use std::collections::HashMap;
+
+use kube::CustomResource;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::monitoring::kube_prometheus::types::{
+    HTTPScheme, MatchExpression, NamespaceSelector, Operator, Selector,
+    ServiceMonitor as KubeServiceMonitor, ServiceMonitorEndpoint,
+};
+
+/// This is the top-level struct for the ServiceMonitor Custom Resource.
+/// The `#[derive(CustomResource)]` macro handles all the boilerplate for you,
+/// including the `impl Resource`.
+#[derive(CustomResource, Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[kube(
+    group = "monitoring.coreos.com",
+    version = "v1",
+    kind = "ServiceMonitor",
+    plural = "servicemonitors",
+    namespaced
+)]
+#[serde(rename_all = "camelCase")]
+pub struct ServiceMonitorSpec {
+    /// A label selector to select services to monitor.
+    pub selector: Selector,
+
+    /// A list of endpoints on the selected services to be monitored.
+    pub endpoints: Vec<ServiceMonitorEndpoint>,
+
+    /// Selector to select which namespaces the Kubernetes Endpoints objects
+    /// are discovered from.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub namespace_selector: Option<NamespaceSelector>,
+
+    /// The label to use to retrieve the job name from.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub job_label: Option<String>,
+
+    /// Pod-based target labels to transfer from the Kubernetes Pod onto the target.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub pod_target_labels: Vec<String>,
+
+    /// TargetLabels transfers labels on the Kubernetes Service object to the target.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub target_labels: Vec<String>,
+}
+
+impl Default for ServiceMonitorSpec {
+    fn default() -> Self {
+        let labels = HashMap::new();
+        Self {
+            selector: Selector {
+                match_labels: { labels },
+                match_expressions: vec![MatchExpression {
+                    key: "app.kubernetes.io/name".into(),
+                    operator: Operator::Exists,
+                    values: vec![],
+                }],
+            },
+            endpoints: vec![ServiceMonitorEndpoint {
+                port: Some("http".to_string()),
+                path: Some("/metrics".into()),
+                interval: Some("30s".into()),
+                scheme: Some(HTTPScheme::HTTP),
+                ..Default::default()
+            }],
+            namespace_selector: None, // only the same namespace
+            job_label: Some("app".into()),
+            pod_target_labels: vec![],
+            target_labels: vec![],
+        }
+    }
+}
+
+impl From<KubeServiceMonitor> for ServiceMonitorSpec {
+    fn from(value: KubeServiceMonitor) -> Self {
+        Self {
+            selector: value.selector,
+            endpoints: value.endpoints,
+            namespace_selector: value.namespace_selector,
+            job_label: value.job_label,
+            pod_target_labels: value.pod_target_labels,
+            target_labels: value.target_labels,
+        }
+    }
+}
--- a/harmony/src/modules/monitoring/kube_prometheus/helm/config.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/helm/config.rs
@@ -27,6 +27,12 @@ pub struct KubePrometheusConfig {
    pub alert_rules: Vec<AlertManagerAdditionalPromRules>,
    pub additional_service_monitors: Vec<ServiceMonitor>,
 }
+impl Default for KubePrometheusConfig {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl KubePrometheusConfig {
    pub fn new() -> Self {
        Self {
@@ -35,7 +41,7 @@ impl KubePrometheusConfig {
            windows_monitoring: false,
            alert_manager: true,
            grafana: true,
-            node_exporter: false,
+            node_exporter: true,
            prometheus: true,
            kubernetes_service_monitors: true,
            kubernetes_api_server: true,
--- a/harmony/src/modules/monitoring/kube_prometheus/helm/kube_prometheus_helm_chart.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/helm/kube_prometheus_helm_chart.rs
@@ -12,8 +12,8 @@ use crate::modules::{
    helm::chart::HelmChartScore,
    monitoring::kube_prometheus::types::{
        AlertGroup, AlertManager, AlertManagerAdditionalPromRules, AlertManagerConfig,
-        AlertManagerRoute, AlertManagerSpec, AlertManagerValues, ConfigReloader, Limits,
-        PrometheusConfig, Requests, Resources,
+        AlertManagerConfigSelector, AlertManagerRoute, AlertManagerSpec, AlertManagerValues,
+        ConfigReloader, Limits, PrometheusConfig, Requests, Resources,
    },
 };

@@ -35,7 +35,7 @@ pub fn kube_prometheus_helm_chart_score(
    let kube_proxy = config.kube_proxy.to_string();
    let kube_state_metrics = config.kube_state_metrics.to_string();
    let node_exporter = config.node_exporter.to_string();
-    let prometheus_operator = config.prometheus_operator.to_string();
+    let _prometheus_operator = config.prometheus_operator.to_string();
    let prometheus = config.prometheus.to_string();
    let resource_limit = Resources {
        limits: Limits {
@@ -64,7 +64,7 @@ pub fn kube_prometheus_helm_chart_score(
            indent_lines(&yaml, indent_level + 2)
        )
    }
-    let resource_section = resource_block(&resource_limit, 2);
+    let _resource_section = resource_block(&resource_limit, 2);

    let mut values = format!(
        r#"
@@ -332,6 +332,11 @@ prometheusOperator:
            .push(receiver.channel_receiver.clone());
    }

+    let mut labels = BTreeMap::new();
+    labels.insert("alertmanagerConfig".to_string(), "enabled".to_string());
+    let alert_manager_config_selector = AlertManagerConfigSelector {
+        match_labels: labels,
+    };
    let alert_manager_values = AlertManagerValues {
        alertmanager: AlertManager {
            enabled: config.alert_manager,
@@ -347,6 +352,8 @@ prometheusOperator:
                        cpu: "100m".to_string(),
                    },
                },
+                alert_manager_config_selector,
+                replicas: 2,
            },
            init_config_reloader: ConfigReloader {
                resources: Resources {
--- a/harmony/src/modules/monitoring/kube_prometheus/mod.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/mod.rs
@@ -1,3 +1,4 @@
+pub mod crd;
 pub mod helm;
 pub mod helm_prometheus_alert_score;
 pub mod prometheus;
--- a/harmony/src/modules/monitoring/kube_prometheus/prometheus.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/prometheus.rs
@@ -55,6 +55,12 @@ pub struct KubePrometheus {
    pub config: Arc<Mutex<KubePrometheusConfig>>,
 }

+impl Default for KubePrometheus {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl KubePrometheus {
    pub fn new() -> Self {
        Self {
@@ -113,8 +119,7 @@ impl KubePrometheus {
        topology: &T,
    ) -> Result<Outcome, InterpretError> {
        kube_prometheus_helm_chart_score(self.config.clone())
-            .create_interpret()
-            .execute(inventory, topology)
+            .interpret(inventory, topology)
            .await
    }
 }
--- a/harmony/src/modules/monitoring/kube_prometheus/types.rs
+++ b/harmony/src/modules/monitoring/kube_prometheus/types.rs
@@ -1,7 +1,8 @@
 use std::collections::{BTreeMap, HashMap};

 use async_trait::async_trait;
-use serde::Serialize;
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
 use serde_yaml::{Mapping, Sequence, Value};

 use crate::modules::monitoring::alert_rule::prometheus_alert_rule::AlertManagerRuleGroup;
@@ -55,6 +56,14 @@ pub struct AlertManagerChannelConfig {
 #[serde(rename_all = "camelCase")]
 pub struct AlertManagerSpec {
    pub(crate) resources: Resources,
+    pub replicas: u32,
+    pub alert_manager_config_selector: AlertManagerConfigSelector,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AlertManagerConfigSelector {
+    pub match_labels: BTreeMap<String, String>,
 }

 #[derive(Debug, Clone, Serialize)]
@@ -86,7 +95,7 @@ pub struct AlertGroup {
    pub groups: Vec<AlertManagerRuleGroup>,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 pub enum HTTPScheme {
    #[serde(rename = "http")]
    HTTP,
@@ -94,7 +103,7 @@ pub enum HTTPScheme {
    HTTPS,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 pub enum Operator {
    In,
    NotIn,
@@ -139,74 +148,83 @@ pub struct ServiceMonitorTLSConfig {
    pub server_name: Option<String>,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema, Default)]
 #[serde(rename_all = "camelCase")]
 pub struct ServiceMonitorEndpoint {
-    // ## Name of the endpoint's service port
-    // ## Mutually exclusive with targetPort
+    /// Name of the service port this endpoint refers to.
    pub port: Option<String>,

-    // ## Name or number of the endpoint's target port
-    // ## Mutually exclusive with port
-    pub target_port: Option<String>,
-
-    // ## File containing bearer token to be used when scraping targets
-    // ##
-    pub bearer_token_file: Option<String>,
-
-    // ## Interval at which metrics should be scraped
-    // ##
+    /// Interval at which metrics should be scraped.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub interval: Option<String>,

-    // ## HTTP path to scrape for metrics
-    // ##
-    pub path: String,
+    /// The HTTP path to scrape for metrics.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,

-    // ## HTTP scheme to use for scraping
-    // ##
-    pub scheme: HTTPScheme,
+    /// HTTP scheme to use for scraping.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub scheme: Option<HTTPScheme>,

-    // ## TLS configuration to use when scraping the endpoint
-    // ##
-    pub tls_config: Option<ServiceMonitorTLSConfig>,
+    /// Relabelings to apply to samples before scraping.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub relabelings: Vec<RelabelConfig>,

-    // ## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.
-    // ## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig
-    // ##
-    // # - action: keep
-    // #   regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'
-    // #   sourceLabels: [__name__]
-    pub metric_relabelings: Vec<Mapping>,
-
-    // ## RelabelConfigs to apply to samples before scraping
-    // ## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig
-    // ##
-    // # - sourceLabels: [__meta_kubernetes_pod_node_name]
-    // #   separator: ;
-    // #   regex: ^(.*)$
-    // #   targetLabel: nodename
-    // #   replacement: $1
-    // #   action: replace
-    pub relabelings: Vec<Mapping>,
+    /// MetricRelabelings to apply to samples after scraping, but before ingestion.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub metric_relabelings: Vec<RelabelConfig>,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct RelabelConfig {
+    /// The action to perform based on the regex matching.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub action: Option<String>,
+
+    /// A list of labels from which to extract values.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub source_labels: Vec<String>,
+
+    /// Separator to be used when concatenating source_labels.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub separator: Option<String>,
+
+    /// The label to which the resulting value is written.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target_label: Option<String>,
+
+    /// A regular expression to match against the concatenated source label values.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub regex: Option<String>,
+
+    /// The replacement value to use.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub replacement: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct MatchExpression {
    pub key: String,
-    pub operator: Operator,
+    pub operator: Operator, // "In", "NotIn", "Exists", "DoesNotExist"
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub values: Vec<String>,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema, Default)]
 #[serde(rename_all = "camelCase")]
 pub struct Selector {
-    //   # label selector for services
+    /// A map of key-value pairs to match.
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
    pub match_labels: HashMap<String, String>,
+
+    /// A list of label selector requirements.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub match_expressions: Vec<MatchExpression>,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ServiceMonitor {
    pub name: String,
@@ -250,10 +268,15 @@ pub struct ServiceMonitor {
    pub fallback_scrape_protocol: Option<String>,
 }

-#[derive(Debug, Serialize, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, JsonSchema, Default)]
 #[serde(rename_all = "camelCase")]
 pub struct NamespaceSelector {
+    /// Select all namespaces.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
    pub any: bool,
+
+    /// List of namespace names to select from.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub match_names: Vec<String>,
 }

@@ -275,19 +298,3 @@ impl Default for ServiceMonitor {
        }
    }
 }
-
-impl Default for ServiceMonitorEndpoint {
-    fn default() -> Self {
-        Self {
-            port: Some("80".to_string()),
-            target_port: Default::default(),
-            bearer_token_file: Default::default(),
-            interval: Default::default(),
-            path: "/metrics".to_string(),
-            scheme: HTTPScheme::HTTP,
-            tls_config: Default::default(),
-            metric_relabelings: Default::default(),
-            relabelings: Default::default(),
-        }
-    }
-}
--- a/harmony/src/modules/monitoring/ntfy/helm/ntfy_helm_chart.rs
+++ b/harmony/src/modules/monitoring/ntfy/helm/ntfy_helm_chart.rs
@@ -1,9 +1,25 @@
 use non_blank_string_rs::NonBlankString;
 use std::str::FromStr;

-use crate::modules::helm::chart::{HelmChartScore, HelmRepository};
+use crate::{modules::helm::chart::HelmChartScore, topology::DeploymentTarget};
+
+pub fn ntfy_helm_chart_score(
+    namespace: String,
+    host: String,
+    target: DeploymentTarget,
+) -> HelmChartScore {
+    // TODO not actually the correct logic, this should be fixed by using an ingresss which is the
+    // correct k8s standard.
+    //
+    // Another option is to delegate to the topology the ingress technology it wants to use Route,
+    // Ingress or other
+    let route_enabled = match target {
+        DeploymentTarget::LocalDev => false,
+        DeploymentTarget::Staging => true,
+        DeploymentTarget::Production => true,
+    };
+    let ingress_enabled = !route_enabled;

-pub fn ntfy_helm_chart_score(namespace: String, host: String) -> HelmChartScore {
    let values = format!(
        r#"
 replicaCount: 1
@@ -25,23 +41,14 @@ serviceAccount:

 service:
  type: ClusterIP
-  port: 80
+  port: 8080

 ingress:
-  enabled: true
-#  annotations:
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  hosts:
-    - host: {host}
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
+  enabled: {ingress_enabled}

+route:
+  enabled: {route_enabled}
+  host: {host}

 autoscaling:
  enabled: false
@@ -49,7 +56,7 @@ autoscaling:
 config:
  enabled: true
  data:
-#    base-url: "https://ntfy.something.com"
+    base-url: "https://{host}"
    auth-file: "/var/cache/ntfy/user.db"
    auth-default-access: "deny-all"
    cache-file: "/var/cache/ntfy/cache.db"
@@ -58,6 +65,8 @@ config:
    # web-root: "disable"
    enable-signup: false
    enable-login: "true"
+    enable-metrics: "true"
+    listen-http: ":8080"

 persistence:
  enabled: true
@@ -68,16 +77,12 @@ persistence:
    HelmChartScore {
        namespace: Some(NonBlankString::from_str(&namespace).unwrap()),
        release_name: NonBlankString::from_str("ntfy").unwrap(),
-        chart_name: NonBlankString::from_str("sarab97/ntfy").unwrap(),
-        chart_version: Some(NonBlankString::from_str("0.1.7").unwrap()),
+        chart_name: NonBlankString::from_str("oci://hub.nationtech.io/harmony/ntfy").unwrap(),
+        chart_version: Some(NonBlankString::from_str("0.1.7-nationtech.1").unwrap()),
        values_overrides: None,
        values_yaml: Some(values.to_string()),
        create_namespace: true,
        install_only: false,
-        repository: Some(HelmRepository::new(
-            "sarab97".to_string(),
-            url::Url::parse("https://charts.sarabsingh.com").unwrap(),
-            true,
-        )),
+        repository: None,
    }
 }
--- a/harmony/src/modules/monitoring/ntfy/mod.rs
+++ b/harmony/src/modules/monitoring/ntfy/mod.rs
@@ -1,2 +1,3 @@
 pub mod helm;
+#[allow(clippy::module_inception)]
 pub mod ntfy;
--- a/harmony/src/modules/monitoring/ntfy/ntfy.rs
+++ b/harmony/src/modules/monitoring/ntfy/ntfy.rs
@@ -1,7 +1,7 @@
 use std::sync::Arc;

 use async_trait::async_trait;
-use log::debug;
+use log::info;
 use serde::Serialize;
 use strum::{Display, EnumString};

@@ -11,7 +11,7 @@ use crate::{
    inventory::Inventory,
    modules::monitoring::ntfy::helm::ntfy_helm_chart::ntfy_helm_chart_score,
    score::Score,
-    topology::{HelmCommand, K8sclient, Topology, k8s::K8sClient},
+    topology::{HelmCommand, K8sclient, MultiTargetTopology, Topology, k8s::K8sClient},
 };

 #[derive(Debug, Clone, Serialize)]
@@ -20,7 +20,7 @@ pub struct NtfyScore {
    pub host: String,
 }

-impl<T: Topology + HelmCommand + K8sclient> Score<T> for NtfyScore {
+impl<T: Topology + HelmCommand + K8sclient + MultiTargetTopology> Score<T> for NtfyScore {
    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
        Box::new(NtfyInterpret {
            score: self.clone(),
@@ -28,7 +28,7 @@ impl<T: Topology + HelmCommand + K8sclient> Score<T> for NtfyScore {
    }

    fn name(&self) -> String {
-        format!("Ntfy")
+        "alert receiver [NtfyScore]".into()
    }
 }

@@ -39,31 +39,21 @@ pub struct NtfyInterpret {

 #[derive(Debug, EnumString, Display)]
 enum NtfyAccessMode {
-    #[strum(serialize = "read-write", serialize = "rw", to_string = "read-write")]
+    #[strum(serialize = "read-write", serialize = "rw")]
    ReadWrite,
-    #[strum(
-        serialize = "read-only",
-        serialize = "ro",
-        serialize = "read",
-        to_string = "read-only"
-    )]
+    #[strum(serialize = "read-only", serialize = "ro", serialize = "read")]
    ReadOnly,
-    #[strum(
-        serialize = "write-only",
-        serialize = "wo",
-        serialize = "write",
-        to_string = "write-only"
-    )]
+    #[strum(serialize = "write-only", serialize = "wo", serialize = "write")]
    WriteOnly,
-    #[strum(serialize = "none", to_string = "deny")]
+    #[strum(serialize = "deny", serialize = "none")]
    Deny,
 }

 #[derive(Debug, EnumString, Display)]
 enum NtfyRole {
-    #[strum(serialize = "user", to_string = "user")]
+    #[strum(serialize = "user")]
    User,
-    #[strum(serialize = "admin", to_string = "admin")]
+    #[strum(serialize = "admin")]
    Admin,
 }

@@ -87,7 +77,7 @@ impl NtfyInterpret {
                vec![
                    "sh",
                    "-c",
-                    format!("NTFY_PASSWORD={password} ntfy user add --role={role} {username}")
+                    format!("NTFY_PASSWORD={password} ntfy user add --role={role} --ignore-exists {username}")
                        .as_str(),
                ],
            )
@@ -95,69 +85,52 @@ impl NtfyInterpret {

        Ok(())
    }
-
-    async fn set_access(
-        &self,
-        k8s_client: Arc<K8sClient>,
-        username: &str,
-        topic: &str,
-        mode: NtfyAccessMode,
-    ) -> Result<(), String> {
-        k8s_client
-            .exec_app(
-                "ntfy".to_string(),
-                Some(&self.score.namespace),
-                vec![
-                    "sh",
-                    "-c",
-                    format!("ntfy access {username} {topic} {mode}").as_str(),
-                ],
-            )
-            .await?;
-
-        Ok(())
-    }
 }

 /// We need a ntfy interpret to wrap the HelmChartScore in order to run the score, and then bootstrap the config inside ntfy
 #[async_trait]
-impl<T: Topology + HelmCommand + K8sclient> Interpret<T> for NtfyInterpret {
+impl<T: Topology + HelmCommand + K8sclient + MultiTargetTopology> Interpret<T> for NtfyInterpret {
    async fn execute(
        &self,
        inventory: &Inventory,
        topology: &T,
    ) -> Result<Outcome, InterpretError> {
-        ntfy_helm_chart_score(self.score.namespace.clone(), self.score.host.clone())
-            .create_interpret()
-            .execute(inventory, topology)
-            .await?;
+        ntfy_helm_chart_score(
+            self.score.namespace.clone(),
+            self.score.host.clone(),
+            topology.current_target(),
+        )
+        .interpret(inventory, topology)
+        .await?;

-        debug!("installed ntfy helm chart");
+        info!("installed ntfy helm chart");
        let client = topology
            .k8s_client()
            .await
            .expect("couldn't get k8s client");

+        info!("deploying ntfy...");
        client
            .wait_until_deployment_ready(
                "ntfy".to_string(),
-                Some(&self.score.namespace.as_str()),
+                Some(self.score.namespace.as_str()),
                None,
            )
            .await?;
-        debug!("created k8s client");
+        info!("ntfy deployed");

+        info!("adding user harmony");
        self.add_user(client, "harmony", "harmony", Some(NtfyRole::Admin))
            .await?;
+        info!("user added");

-        debug!("exec into pod done");
-
-        Ok(Outcome::success("installed ntfy".to_string()))
+        Ok(Outcome::success("Ntfy installed".to_string()))
    }

    fn get_name(&self) -> InterpretName {
-        todo!()
+        InterpretName::Ntfy
    }
+
    fn get_version(&self) -> Version {
        todo!()
    }
--- a/harmony/src/modules/monitoring/prometheus/mod.rs
+++ b/harmony/src/modules/monitoring/prometheus/mod.rs
@@ -1,3 +1,4 @@
 pub mod helm;
+#[allow(clippy::module_inception)]
 pub mod prometheus;
 pub mod prometheus_config;
--- a/harmony/src/modules/monitoring/prometheus/prometheus.rs
+++ b/harmony/src/modules/monitoring/prometheus/prometheus.rs
@@ -37,6 +37,12 @@ impl AlertSender for Prometheus {
    }
 }

+impl Default for Prometheus {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl Prometheus {
    pub fn new() -> Self {
        Self {
@@ -94,8 +100,7 @@ impl Prometheus {
        topology: &T,
    ) -> Result<Outcome, InterpretError> {
        prometheus_helm_chart_score(self.config.clone())
-            .create_interpret()
-            .execute(inventory, topology)
+            .interpret(inventory, topology)
            .await
    }
    pub async fn install_grafana<T: Topology + HelmCommand + Send + Sync>(
@@ -110,13 +115,12 @@ impl Prometheus {

        if let Some(ns) = namespace.as_deref() {
            grafana_helm_chart_score(ns)
-                .create_interpret()
-                .execute(inventory, topology)
+                .interpret(inventory, topology)
                .await
        } else {
-            Err(InterpretError::new(format!(
-                "could not install grafana, missing namespace",
-            )))
+            Err(InterpretError::new(
+                "could not install grafana, missing namespace".to_string(),
+            ))
        }
    }
 }
--- a/harmony/src/modules/monitoring/prometheus/prometheus_config.rs
+++ b/harmony/src/modules/monitoring/prometheus/prometheus_config.rs
@@ -16,6 +16,12 @@ pub struct PrometheusConfig {
    pub additional_service_monitors: Vec<ServiceMonitor>,
 }

+impl Default for PrometheusConfig {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl PrometheusConfig {
    pub fn new() -> Self {
        Self {
--- a/harmony/src/modules/okd/bootstrap_dhcp.rs
+++ b/harmony/src/modules/okd/bootstrap_dhcp.rs
@@ -32,7 +32,7 @@ impl OKDBootstrapDhcpScore {
            logical_host: topology.bootstrap_host.clone(),
            physical_host: inventory
                .worker_host
-                .get(0)
+                .first()
                .expect("Should have at least one worker to be used as bootstrap node")
                .clone(),
        });
--- a/harmony/src/modules/okd/upgrade.rs
+++ b/harmony/src/modules/okd/upgrade.rs
@@ -6,6 +6,12 @@ pub struct OKDUpgradeScore {
    _target_version: Version,
 }

+impl Default for OKDUpgradeScore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl OKDUpgradeScore {
    pub fn new() -> Self {
        Self {
--- a/harmony/src/modules/prometheus/alerts/k8s/deployment.rs
+++ b/harmony/src/modules/prometheus/alerts/k8s/deployment.rs
@@ -0,0 +1,23 @@
+use std::collections::HashMap;
+
+use crate::modules::monitoring::alert_rule::prometheus_alert_rule::PrometheusAlertRule;
+
+pub fn alert_deployment_unavailable() -> PrometheusAlertRule {
+    PrometheusAlertRule {
+        alert: "DeploymentUnavailable".into(),
+        expr: "kube_deployment_status_replicas_unavailable > 0".into(),
+        r#for: Some("2m".into()),
+        labels: HashMap::from([("severity".into(), "warning".into())]),
+        annotations: HashMap::from([
+            (
+                "summary".into(),
+                "Deployment has unavailable replicas".into(),
+            ),
+            (
+                "description".into(),
+                "A deployment in this namespace has unavailable replicas for over 2 minutes."
+                    .into(),
+            ),
+        ]),
+    }
+}
--- a/harmony/src/modules/prometheus/alerts/k8s/memory_usage.rs
+++ b/harmony/src/modules/prometheus/alerts/k8s/memory_usage.rs
@@ -0,0 +1,37 @@
+use std::collections::HashMap;
+
+use crate::modules::monitoring::alert_rule::prometheus_alert_rule::PrometheusAlertRule;
+
+pub fn alert_high_memory_usage() -> PrometheusAlertRule {
+    PrometheusAlertRule {
+        alert: "HighMemoryUsage".into(),
+        expr: "container_memory_working_set_bytes{container!=\"\",namespace!=\"\"} > 500000000"
+            .into(),
+        r#for: Some("2m".into()),
+        labels: HashMap::from([("severity".into(), "warning".into())]),
+        annotations: HashMap::from([
+            ("summary".into(), "Pod is using high memory".into()),
+            (
+                "description".into(),
+                "A pod is consuming more than 500Mi of memory.".into(),
+            ),
+        ]),
+    }
+}
+
+pub fn alert_high_cpu_usage() -> PrometheusAlertRule {
+    PrometheusAlertRule {
+        alert: "HighCPUUsage".into(),
+        expr: "rate(container_cpu_usage_seconds_total{container!=\"\",namespace!=\"\"}[1m]) > 0.9"
+            .into(),
+        r#for: Some("1m".into()),
+        labels: HashMap::from([("severity".into(), "warning".into())]),
+        annotations: HashMap::from([
+            ("summary".into(), "Pod is using high CPU".into()),
+            (
+                "description".into(),
+                "A pod is using more than 90% of a core over 1 minute.".into(),
+            ),
+        ]),
+    }
+}
--- a/harmony/src/modules/prometheus/alerts/k8s/mod.rs
+++ b/harmony/src/modules/prometheus/alerts/k8s/mod.rs
@@ -1 +1,5 @@
+pub mod deployment;
+pub mod memory_usage;
+pub mod pod;
 pub mod pvc;
+pub mod service;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jean-Gabriel Gill-Couture	26e8e386b9	feat: Secret module works with infisical and local file storage backends All checks were successful Run Check Script / check (pull_request) Successful in 1m9s Details	2025-08-19 11:59:21 -04:00
Jean-Gabriel Gill-Couture	2a6a233fb2	feat: WIP add secrets module and macro crate	2025-08-15 14:40:39 -04:00
Ian Letourneau	67f3a23071	chore: cleanup unused imports All checks were successful Run Check Script / check (push) Successful in 1m30s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 5m33s Details	2025-08-14 16:44:22 -04:00
Ian Letourneau	d86970f81b	fix: make sure demo works on both local & remote target (#107 ) Some checks failed Compile and package harmony_composer / package_harmony_composer (push) Waiting to run Details Run Check Script / check (push) Has been cancelled Details * define Ntfy ingress (naive implementation) based on current target * use patched Ntfy Helm Chart * create Ntfy main user only if needed * add info logs * better error bubbling * instrument feature installations * upgrade prometheus alerting charts if already installed * harmony_composer params to control deployment `target` and `profile` Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Co-authored-by: Jean-Gabriel Gill-Couture <jg@nationtech.io> Reviewed-on: #107	2025-08-14 20:42:09 +00:00
Ian Letourneau	623a3f019b	fix: apply different network policies based on current target (#97 ) Some checks failed Compile and package harmony_composer / package_harmony_composer (push) Waiting to run Details Run Check Script / check (push) Has been cancelled Details Fixes #94 Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: #97 Reviewed-by: johnride <jg@nationtech.io>	2025-08-14 20:36:19 +00:00
Ian Letourneau	bd214f8fb8	fix: remove sha256 for harmony composer image in harmony_composer workflow All checks were successful Run Check Script / check (push) Successful in 1m9s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 6m11s Details	2025-08-11 19:49:06 -04:00
Ian Letourneau	f0ed548755	fix: improve usage of indicatif for tracking progress (#101 ) Some checks failed Run Check Script / check (push) Successful in 1m18s Details Compile and package harmony_composer / package_harmony_composer (push) Failing after -1s Details The multiprogress wasn't used properly and leading to conflicting progress bars (within our own progress bars, as well as the log wrapper). This PR introduce a layer on top of `indicatif::MultiProgress` to properly handle sections of progress bars, where we can dynamically add/update/remove progress bars from any sections. We can see in the demo that new sections + progress bars are added on the fly and that extra logs (e.g. info logs) are appended on top of the progress bars. Progress are also grouped together based on their parent score. Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Co-authored-by: johnride <jg@nationtech.io> Reviewed-on: #101	2025-08-11 23:47:11 +00:00
Ian Letourneau	1de96027a1	fix: prevent instrumentation to run in test mode (#102 ) Some checks failed Run Check Script / check (push) Successful in 1m16s Details Compile and package harmony_composer / package_harmony_composer (push) Failing after -1s Details The CI pipeline (`./check.sh`) was failing because of test errors, which was caused by the instrumentation framework complaining that no subscribers/listeners were registered. Instead of setting up all tests to run with a dummy subscriber, move the implementation of the instrumentation behind a feature flag so that it runs only for tests. There's a catch though: the `#[cfg(test)]` directive works only when directly testing the crate. If a crate `A` depends on another crate `B`, `B` will be compiled as usual (aka not in test mode) which will not trigger the `test` flag. So we need to introduce our own `testing` feature flag for `harmony` core and import it with that flag (only during dev/test). More info: https://github.com/rust-lang/rust/issues/59168 Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: https://git.nationtech.io/NationTech/harmony/pulls/102	2025-08-11 23:42:08 +00:00
Jean-Gabriel Gill-Couture	0812937a67	fix(ci): Remove specific sha256 for harmony composer image, just always run on latest Some checks failed Compile and package harmony_composer / package_harmony_composer (push) Successful in 7m22s Details Run Check Script / check (push) Failing after 2m0s Details	2025-08-11 15:52:37 -04:00
Ian Letourneau	29a261575b	refactor: Interpret score with a provided method on Score (#100 ) Some checks failed Compile and package harmony_composer / package_harmony_composer (push) Successful in 6m49s Details Run Check Script / check (push) Failing after 41s Details First step in a direction to better orchestrate the core flow, even though it feels weird to move this logic into the `Score`. We'll refactor this as soon as we have a better solution. Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: #100	2025-08-09 22:56:23 +00:00
Ian Letourneau	dcf8335240	Merge pull request 'refactor: Remove InterpretStatus/Error & Outcome from Topology' (#99 ) from remove-interpret-status-from-topology into master Some checks are pending Run Check Script / check (push) Waiting to run Details Compile and package harmony_composer / package_harmony_composer (push) Waiting to run Details Reviewed-on: #99 Reviewed-by: johnride <jg@nationtech.io>	2025-08-09 22:52:21 +00:00
Ian Letourneau	f876b5e67b	refactor: Remove InterpretStatus/Error & Outcome from Topology Some checks failed Run Check Script / check (pull_request) Has been cancelled Details	2025-08-06 22:29:00 -04:00
Ian Letourneau	440c1bce12	chore: reformat & clippy cleanup (#96 ) Some checks failed Run Check Script / check (pull_request) Has been cancelled Details Run Check Script / check (push) Has been cancelled Details Compile and package harmony_composer / package_harmony_composer (push) Has been cancelled Details Clippy is now added to the `check` in the pipeline Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: #96	2025-08-06 15:57:14 +00:00
Willem	024084859e	Monitor an application within a tenant (#86 ) All checks were successful Run Check Script / check (push) Successful in -45s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 4m35s Details WIP: added implementation to deploy crd-alertmanagerconfigs Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: #86 Co-authored-by: Willem <wrolleman@nationtech.io> Co-committed-by: Willem <wrolleman@nationtech.io>	2025-08-04 21:42:01 +00:00
Ian Letourneau	54990cd1a5	fix(cli): simplify running the CLI by hiding the maestro inside the implemtation (#93 ) All checks were successful Run Check Script / check (push) Successful in -46s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 4m36s Details Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: #93	2025-08-04 20:59:07 +00:00
Ian Letourneau	06aab1f57f	fix(cli): reduce noise & better track progress within Harmony (#91 ) All checks were successful Run Check Script / check (push) Successful in -37s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 9m6s Details Introduce a way to instrument what happens within Harmony and around Harmony (e.g. in the CLI or in Composer). The goal is to provide visual feedback to the end users and inform them of the progress of their tasks (e.g. deployment) as clearly as possible. It is important to also let them know of the outcome of their tasks (what was created, where to access stuff, etc.). <img src="https://media.discordapp.net/attachments/1295353830300713062/1400289618636574741/demo.gif?ex=688c18d5&is=688ac755&hm=2c70884aacb08f7bd15cbb65a7562a174846906718aa15294bbb238e64febbce&=" /> ## Changes ### Instrumentation architecture Extensibility and ease of use is key here, while preserving type safety as much as possible. The proposed API is quite simple: ```rs // Emit an event instrumentation::instrument( HarmonyEvent::TopologyPrepared { topology: "k8s-anywhere", outcome: Outcome::success("yay") } ); // Consume events instrumentation::subscribe("Harmony CLI Logger", async \|event\| { match event { HarmonyEvent::TopologyPrepared { name, outcome } => todo!(), } }); ``` #### Current limitations * this API is not very extensible, but it could be easily changed to allow end users to define custom events in addition to Harmony core events * we use a tokio broadcast channel behind the scene so only in process communication can happen, but it could be easily changed to a more flexible communication mechanism as implementation details are hidden ### `harmony_composer` VS `harmony_cli` As Harmony Composer launches commands from Harmony (CLI), they both live in different processes. And because of this, we cannot easily make all the logging happens in one place (Harmony Composer) and get rid of Harmony CLI. At least not without introducing additional complexity such as communication through a server, unix socket, etc. So for the time being, it was decided to preserve both `harmony_composer` and `harmony_cli` and let them independently log their stuff and handle their own responsibilities: * `harmony_composer`: takes care only of setting up & packaging a project, delegates everything else to `harmony_cli` * `harmony_cli`: takes care of configuring & running Harmony ### Logging & prompts * [indicatif](https://github.com/console-rs/indicatif) is used to create progress bars and track progress within Harmony, Harmony CLI, and Harmony Composer * [inquire](https://github.com/mikaelmello/inquire) is preserved, but was removed from `harmony` (core) as UI concerns shouldn't go that deep * note: for now the only prompt we had was simply deleted, we'll have to find a better way to prompt stuff in the future ## Todos * [ ] Update/Create ADRs * [ ] Continue instrumentation for missing branches * [ ] Allow instrumentation to emit and subscribe to custom events Co-authored-by: Ian Letourneau <letourneau.ian@gmail.com> Reviewed-on: #91 Reviewed-by: johnride <jg@nationtech.io>	2025-07-31 19:35:33 +00:00
Ian Letourneau	1ab66af718	Merge pull request 'refactor(topo/k8s_anywhere): simplify local installation of k3d' (#90 ) from simply-k3d-installation into master Some checks failed Run Check Script / check (push) Failing after -1m14s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 3m23s Details Reviewed-on: #90 Reviewed-by: wjro <wrolleman@nationtech.io>	2025-07-31 13:22:25 +00:00
Ian Letourneau	0fff4ef566	refactor(topo/k8s_anywhere): simplify local installation of k3d All checks were successful Run Check Script / check (pull_request) Successful in -37s Details A Maestro was initialized with a new inventory simply to provide a localhost topology to install K3D locally. But in practice, the K3D installation wasn't actually using the topology nor the inventory. Directly installing K3D within the K8s Anywhere topology makes things simpler and actually enforce the topology to provide the capabilities required to install K3D.	2025-07-27 11:50:48 -04:00
Ian Letourneau	d95e84d6fc	Merge pull request 'fix(apps/rust): build & push using image tag instead of local VS remote image name' (#87 ) from fix-image-tag into master All checks were successful Run Check Script / check (push) Successful in -37s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 13m2s Details Reviewed-on: #87 Reviewed-by: johnride <jg@nationtech.io>	2025-07-27 14:10:19 +00:00
Ian Letourneau	a47be890de	Merge branch 'master' into fix-image-tag All checks were successful Run Check Script / check (pull_request) Successful in -38s Details	2025-07-27 14:09:24 +00:00
Ian Letourneau	ee8dfa4a93	Merge pull request 'chore: cleanup of unnecessary files & adjust gitignores' (#88 ) from quick-cleanup into master Some checks failed Run Check Script / check (push) Successful in -37s Details Compile and package harmony_composer / package_harmony_composer (push) Has been cancelled Details Reviewed-on: #88 Reviewed-by: johnride <jg@nationtech.io>	2025-07-27 14:08:57 +00:00
Ian Letourneau	5d41cc8380	Merge branch 'master' into quick-cleanup All checks were successful Run Check Script / check (pull_request) Successful in -34s Details	2025-07-27 14:07:55 +00:00
johnride	cef745b642	Merge pull request 'log(composer): Log check_path_str value when error' (#77 ) from log/composer into master All checks were successful Run Check Script / check (push) Successful in -31s Details Compile and package harmony_composer / package_harmony_composer (push) Successful in 11m59s Details Reviewed-on: #77	2025-07-21 18:04:57 +00:00
Jean-Gabriel Gill-Couture	d9959378a6	log(composer): Log check_path_str value when error All checks were successful Run Check Script / check (pull_request) Successful in -37s Details	2025-07-21 09:15:41 -04:00
Ian Letourneau	07f1151e4c	chore: cleanup of unncessary files & adjust gitignores All checks were successful Run Check Script / check (pull_request) Successful in -31s Details	2025-07-20 20:03:26 -04:00
Ian Letourneau	f7625f0484	fix(rust): push only the actual image tag All checks were successful Run Check Script / check (pull_request) Successful in -22s Details	2025-07-16 13:51:02 -04:00