From 06458e2267cc1ce27d4e67f0c5b273543ed160cd Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Fri, 3 Jul 2026 10:29:58 -0400
Subject: [PATCH 1/8] fix(chart): clean stack tunnel wiring changes

---
 .../templates/configmap.yaml                  |   7 +-
 charts/kubex-automation-stack/Chart.lock      |  10 +-
 charts/kubex-automation-stack/Chart.yaml      |  10 +-
 charts/kubex-automation-stack/README.md       |  12 ++
 .../templates/_helpers.tpl                    |  13 ++
 .../templates/kubex-ai-cdi-clusterrole.yaml   | 111 ++++++++++++++++++
 .../kubex-ai-cdi-clusterrolebinding.yaml      |  34 ++++++
 .../kubex-ai-cdi-serviceaccount.yaml          |  26 ++++
 .../kubex-automation-stack/values-edit.yaml   |  20 +++-
 .../values-openshift.yaml                     |  25 ++++
 charts/kubex-automation-stack/values.yaml     |  87 ++++++++++++++
 11 files changed, 344 insertions(+), 11 deletions(-)
 create mode 100644 charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrole.yaml
 create mode 100644 charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml
 create mode 100644 charts/kubex-automation-stack/templates/kubex-ai-cdi-serviceaccount.yaml

diff --git a/charts/container-optimization-data-forwarder/templates/configmap.yaml b/charts/container-optimization-data-forwarder/templates/configmap.yaml
index a0f1207..22874b6 100644
--- a/charts/container-optimization-data-forwarder/templates/configmap.yaml
+++ b/charts/container-optimization-data-forwarder/templates/configmap.yaml
@@ -8,12 +8,15 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+{{- $densifyUrl := .Values.config.forwarder.densify.url | required ".Values.config.forwarder.densify.url is required." }}
+{{- $densifyHost := $densifyUrl.host | required ".Values.config.forwarder.densify.url.host is required." }}
 data:
+  kubex_host: {{ $densifyHost | quote }}
+  kubex_tenant_id: {{ index (splitList "." $densifyHost) 0 | quote }}
+  kubex_cluster_name: {{ (first .Values.config.clusters).name | quote }}
   config.yaml : |
     forwarder:
       densify:
-{{- $densifyUrl := .Values.config.forwarder.densify.url | required ".Values.config.forwarder.densify.url is required." }}
-{{- $densifyHost := $densifyUrl.host | required ".Values.config.forwarder.densify.url.host is required." }}
         url: {{- omit $densifyUrl "UserSecretName" | toYaml | trim | nindent 10 }}
 {{- if .Values.config.forwarder.densify.endpoint }}
         endpoint: {{ .Values.config.forwarder.densify.endpoint }}
diff --git a/charts/kubex-automation-stack/Chart.lock b/charts/kubex-automation-stack/Chart.lock
index 896c0b0..4697c90 100644
--- a/charts/kubex-automation-stack/Chart.lock
+++ b/charts/kubex-automation-stack/Chart.lock
@@ -2,6 +2,12 @@ dependencies:
 - name: container-optimization-data-forwarder
   repository: https://densify-dev.github.io/helm-charts
   version: 4.0.17
+- name: kubex-connector
+  repository: https://densify-dev.github.io/helm-charts
+  version: 0.1.7
+- name: kubex-ai-cdi
+  repository: https://densify-dev.github.io/helm-charts
+  version: 0.1.7
 - name: prometheus
   repository: https://prometheus-community.github.io/helm-charts
   version: 29.13.0
@@ -17,5 +23,5 @@ dependencies:
 - name: node-labeler
   repository: https://densify-dev.github.io/helm-charts
   version: 0.1.2
-digest: sha256:c498ce4d74c71ae798389273aa7a982b7b5bab36fda22cf138ce8d9fc7df4d91
-generated: "2026-06-23T13:15:52.035420594-04:00"
+digest: sha256:236fb101181ec35633ff5b63d691d7a2d812db1c1e12bdc6aef31b53802bcb81
+generated: "2026-06-18T17:22:19.699220044-04:00"
diff --git a/charts/kubex-automation-stack/Chart.yaml b/charts/kubex-automation-stack/Chart.yaml
index 7bd92cb..facfaa9 100644
--- a/charts/kubex-automation-stack/Chart.yaml
+++ b/charts/kubex-automation-stack/Chart.yaml
@@ -1,13 +1,21 @@
 apiVersion: v2
 description: Kubex Collection Stack
 name: kubex-automation-stack
-version: 1.0.17
+version: 1.0.18
 type: application
 icon: https://kubex.ai/wp-content/uploads/kubex-logo-landscape.svg
 dependencies:
   - name: container-optimization-data-forwarder
     version: "4.*.*"
     repository: https://densify-dev.github.io/helm-charts
+  - name: kubex-connector
+    version: "0.1.*"
+    repository: https://densify-dev.github.io/helm-charts
+    condition: kubex-connector.enabled
+  - name: kubex-ai-cdi
+    version: "0.1.*"
+    repository: https://densify-dev.github.io/helm-charts
+    condition: kubex-ai-cdi.enabled
   - name: prometheus
     version: "29.*.*"
     repository: https://prometheus-community.github.io/helm-charts
diff --git a/charts/kubex-automation-stack/README.md b/charts/kubex-automation-stack/README.md
index b7df668..45db031 100644
--- a/charts/kubex-automation-stack/README.md
+++ b/charts/kubex-automation-stack/README.md
@@ -115,6 +115,14 @@ The following table lists configuration parameters in `values-edit.yaml`.
 | `beyla.enabled`                                                           |                    | Enable Grafana Beyla for application runtime detection (default: `true`) |
 | `k8s-ephemeral-storage-metrics.enabled`                                          |                    | Enable ephemeral storage metrics collection (default: `true`) |
 | `node-labeler.enabled`                                                           |                    | Enable optional node-labeler subchart (default: `false`) |
+| `kubex-connector.enabled`                                                        |                    | Enable optional connector subchart (default: `false`) |
+| `kubex-ai-cdi.enabled`                                                           |                    | Enable optional kubex-ai-cdi subchart (default: `false`) |
+| `kubex-connector.heartbeatSeconds`                                               |                    | Connector heartbeat interval in seconds |
+| `kubex-connector.requestTimeoutSeconds`                                          |                    | Connector request timeout in seconds |
+
+Connector and CDI use the shared Kubex host and cluster entered under `container-optimization-data-forwarder.config.*`. The forwarder publishes those runtime values in its `ConfigMap`, and the connector consumes them through `forwarderConfigMap.name`. Credentials come from `stack.densify` through `densify-api-secret`, which the connector consumes through `forwarderCredentialsSecretRef.name` by default. The stack chart also owns the CDI service account and RBAC by rendering those manifests itself while disabling `kubex-ai-cdi.rbac.enabled` in the subchart.
+
+For the full stack RBAC shape and defaults, refer to `charts/kubex-automation-stack/values.yaml`.
 
 ## Limitations
 
@@ -137,6 +145,10 @@ This chart consists of the following subcharts:
 
 * [Node Labeler](../node-labeler) - Adds labels to nodes to indicate which Kubex Node Group they belong to. This is an optional component that can be enabled if desired (disabled by default).
 
+* [Kubex Connector](../kubex-ai-connector) - Optional in-cluster connector used for the cluster data interface.
+
+* [kubex-ai-cdi](../kubex-ai-cdi) - Optional in-cluster Kubex cluster data interface service.
+
 ## Documentation
 
 * [Kubex](https://docs.kubex.ai)
diff --git a/charts/kubex-automation-stack/templates/_helpers.tpl b/charts/kubex-automation-stack/templates/_helpers.tpl
index fbceba1..9f9c4d4 100644
--- a/charts/kubex-automation-stack/templates/_helpers.tpl
+++ b/charts/kubex-automation-stack/templates/_helpers.tpl
@@ -1,6 +1,19 @@
 {{- define "common.namespace" -}}
   {{- default .Release.Namespace .Values.nsPrefix -}}
 {{- end -}}
+{{- define "common.kubexHost" -}}
+{{- $forwarder := index .Values "container-optimization-data-forwarder" | default dict -}}
+{{- $config := $forwarder.config | default dict -}}
+{{- $densify := $config.forwarder.densify | default dict -}}
+{{- $url := $densify.url | default dict -}}
+{{- trim (default "" $url.host) -}}
+{{- end -}}
+{{- define "common.kubexClusters" -}}
+{{- $forwarder := index .Values "container-optimization-data-forwarder" | default dict -}}
+{{- $config := $forwarder.config | default dict -}}
+{{- $clusters := $config.clusters | default list -}}
+{{- toYaml $clusters -}}
+{{- end -}}
 {{- define "common.checkValues" -}}
 {{- $openshiftEnabled := .Values.openshift.enabled -}}
 {{- $deployPrometheus := .Values.stack.prometheus.deploy -}}
diff --git a/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrole.yaml b/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrole.yaml
new file mode 100644
index 0000000..d27dfd4
--- /dev/null
+++ b/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrole.yaml
@@ -0,0 +1,111 @@
+{{- $rbac := .Values.rbac | default dict -}}
+{{- $cdi := $rbac.permissions.cdi | default dict -}}
+{{- $rules := $cdi.rules | default dict -}}
+{{- $clusterRole := $cdi.clusterRole | default dict -}}
+{{- $cdiValues := index .Values "kubex-ai-cdi" | default dict -}}
+{{- $cdiRbac := $cdiValues.rbac | default dict -}}
+{{- $extraLabels := $cdiValues.extraLabels | default dict -}}
+{{- $extraAnnotations := $cdiValues.extraAnnotations | default dict -}}
+{{- if and $cdiValues.enabled $rbac.create (not ($cdiRbac.enabled | default false)) (dig "create" false $clusterRole) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ default "kubex-ai-cdi-reader" (dig "name" "" $clusterRole) }}
+  labels:
+    app: kubex-ai-cdi
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if $extraLabels }}
+    {{- toYaml $extraLabels | nindent 4 }}
+    {{- end }}
+  {{- if $extraAnnotations }}
+  annotations:
+    {{- toYaml $extraAnnotations | nindent 4 }}
+  {{- end }}
+rules:
+{{- with $rules.core }}
+{{- if .enabled }}
+- apiGroups: [""]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- with $rules.podLogs }}
+{{- if .enabled }}
+- apiGroups: [""]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- with $rules.workloads }}
+{{- if .enabled }}
+- apiGroups: ["apps"]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- with $rules.rollouts }}
+{{- if .enabled }}
+- apiGroups: ["argoproj.io"]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- $openshiftRule := $rules.openshift | default dict -}}
+{{- $openshiftEnabled := dig "enabled" nil $openshiftRule -}}
+{{- if eq $openshiftEnabled nil -}}
+{{- $openshiftEnabled = .Values.openshift.enabled -}}
+{{- end -}}
+{{- if $openshiftEnabled }}
+- apiGroups: ["machine.openshift.io"]
+  resources:
+    {{- toYaml ((dig "resources" (list) $openshiftRule)) | nindent 4 }}
+  verbs:
+    {{- toYaml ((dig "verbs" (list) $openshiftRule)) | nindent 4 }}
+{{- end }}
+{{- with $rules.karpenter }}
+{{- if .enabled }}
+- apiGroups: ["karpenter.sh"]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- with $rules.karpenterAWS }}
+{{- if .enabled }}
+- apiGroups: ["karpenter.k8s.aws"]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- with $rules.kubexCRDs }}
+{{- if .enabled }}
+- apiGroups: ["rightsizing.kubex.ai"]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- with $rules.selfSubjectReview }}
+{{- if .enabled }}
+- apiGroups: ["authorization.k8s.io"]
+  resources:
+    {{- toYaml (.resources | default (list)) | nindent 4 }}
+  verbs:
+    {{- toYaml (.verbs | default (list)) | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml b/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml
new file mode 100644
index 0000000..7fb55d4
--- /dev/null
+++ b/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml
@@ -0,0 +1,34 @@
+{{- $rbac := .Values.rbac | default dict -}}
+{{- $cdi := $rbac.permissions.cdi | default dict -}}
+{{- $clusterRole := $cdi.clusterRole | default dict -}}
+{{- $serviceAccount := $cdi.serviceAccount | default dict -}}
+{{- $cdiValues := index .Values "kubex-ai-cdi" | default dict -}}
+{{- $cdiRbac := $cdiValues.rbac | default dict -}}
+{{- $extraLabels := $cdiValues.extraLabels | default dict -}}
+{{- $extraAnnotations := $cdiValues.extraAnnotations | default dict -}}
+{{- if and $cdiValues.enabled $rbac.create (not ($cdiRbac.enabled | default false)) (dig "create" false $clusterRole) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ default "kubex-ai-cdi-reader" (dig "name" "" $clusterRole) }}
+  labels:
+    app: kubex-ai-cdi
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if $extraLabels }}
+    {{- toYaml $extraLabels | nindent 4 }}
+    {{- end }}
+  {{- if $extraAnnotations }}
+  annotations:
+    {{- toYaml $extraAnnotations | nindent 4 }}
+  {{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ default "kubex-ai-cdi-sa" (dig "name" "" $serviceAccount) }}
+  namespace: {{ template "common.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ default "kubex-ai-cdi-reader" (dig "name" "" $clusterRole) }}
+{{- end }}
diff --git a/charts/kubex-automation-stack/templates/kubex-ai-cdi-serviceaccount.yaml b/charts/kubex-automation-stack/templates/kubex-ai-cdi-serviceaccount.yaml
new file mode 100644
index 0000000..863a449
--- /dev/null
+++ b/charts/kubex-automation-stack/templates/kubex-ai-cdi-serviceaccount.yaml
@@ -0,0 +1,26 @@
+{{- $rbac := .Values.rbac | default dict -}}
+{{- $cdi := $rbac.permissions.cdi | default dict -}}
+{{- $serviceAccount := $cdi.serviceAccount | default dict -}}
+{{- $cdiValues := index .Values "kubex-ai-cdi" | default dict -}}
+{{- $cdiRbac := $cdiValues.rbac | default dict -}}
+{{- $extraLabels := $cdiValues.extraLabels | default dict -}}
+{{- $extraAnnotations := $cdiValues.extraAnnotations | default dict -}}
+{{- if and $cdiValues.enabled $rbac.create (not ($cdiRbac.enabled | default false)) (dig "create" false $serviceAccount) }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ default "kubex-ai-cdi-sa" (dig "name" "" $serviceAccount) }}
+  namespace: {{ template "common.namespace" . }}
+  labels:
+    app: kubex-ai-cdi
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if $extraLabels }}
+    {{- toYaml $extraLabels | nindent 4 }}
+    {{- end }}
+  {{- if $extraAnnotations }}
+  annotations:
+    {{- toYaml $extraAnnotations | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/kubex-automation-stack/values-edit.yaml b/charts/kubex-automation-stack/values-edit.yaml
index 05f14ce..b4842f1 100644
--- a/charts/kubex-automation-stack/values-edit.yaml
+++ b/charts/kubex-automation-stack/values-edit.yaml
@@ -17,12 +17,20 @@ container-optimization-data-forwarder:
     clusters:
       - name: '<changeme-cluster-name>' # mandatory
 
-  # Optional: Additional labels to add to CronJob and Job resources
-  #extraLabels:
-  #  my-custom-label: my-value-1
-  # Optional: Additional annotations to add to CronJob and Job resources
-  #extraAnnotations:
-  #  my-custom-annotation: my-value-2
+# Optional: Enable the connector and CDI tunnel path.
+# Keep these opt-in until the feature is generally available in production.
+# kubex-connector:
+#   enabled: true
+#
+# kubex-ai-cdi:
+#   enabled: true
+
+#   Optional: Additional labels inherited by CDI resources
+#   extraLabels:
+#     my-custom-label: my-value-1
+#   Optional: Additional annotations inherited by CDI resources
+#   extraAnnotations:
+#     my-custom-annotation: my-value-2
 
 # The following values are optional, if job cleanup is required;
 # each one of these should be a non-negative integer (0 is allowed)
diff --git a/charts/kubex-automation-stack/values-openshift.yaml b/charts/kubex-automation-stack/values-openshift.yaml
index edad3b8..759661f 100644
--- a/charts/kubex-automation-stack/values-openshift.yaml
+++ b/charts/kubex-automation-stack/values-openshift.yaml
@@ -8,6 +8,7 @@ stack:
 container-optimization-data-forwarder:
   assignedUIDs: true
   job:
+    enable: false
     checkPrometheusReady: false
   config:
     prometheus:
@@ -37,6 +38,30 @@ k8s-ephemeral-storage-metrics:
     interval: 30s
     scrapeTimeout: 10s
 
+kubex-connector:
+  securityContext:
+    runAsUser: 1000750000
+    runAsGroup: 1000750000
+    fsGroup: 1000750000
+  containerSecurityContext:
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+
+kubex-ai-cdi:
+  securityContext:
+    runAsUser: 1000750000
+    runAsGroup: 1000750000
+    fsGroup: 1000750000
+  containerSecurityContext:
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+
 gpu-process-exporter:
   enabled: false
 
diff --git a/charts/kubex-automation-stack/values.yaml b/charts/kubex-automation-stack/values.yaml
index b2d2464..4b293d1 100644
--- a/charts/kubex-automation-stack/values.yaml
+++ b/charts/kubex-automation-stack/values.yaml
@@ -6,6 +6,76 @@
 openshift:
   enabled: false
 
+rbac:
+  create: true
+  permissions:
+    cdi:
+      serviceAccount:
+        create: true
+        name: kubex-ai-cdi-sa
+      clusterRole:
+        create: true
+        name: kubex-ai-cdi-reader
+      clusterRoleBinding:
+        create: true
+        name: kubex-ai-cdi-reader
+      role:
+        create: false
+        name: kubex-ai-cdi-reader
+      roleBinding:
+        create: false
+        name: kubex-ai-cdi-reader
+      rules:
+        core:
+          enabled: true
+          resources: ["pods", "services", "configmaps", "namespaces", "nodes", "events"]
+          verbs: ["get", "list"]
+        podLogs:
+          enabled: true
+          resources: ["pods/log"]
+          verbs: ["get"]
+        workloads:
+          enabled: true
+          resources: ["deployments", "daemonsets", "statefulsets", "replicasets"]
+          verbs: ["get", "list"]
+        # Automatically enable OpenShift permissions when openshift mode is on.
+        openshift:
+          enabled: null
+          resources: ["machines", "machinesets", "machinedeployments", "machinehealthchecks", "controlplanemachinesets"]
+          verbs: ["get", "list"]
+        karpenter:
+          enabled: true
+          resources: ["nodepools", "nodeclaims"]
+          verbs: ["get", "list"]
+        karpenterAWS:
+          enabled: true
+          resources: ["ec2nodeclasses"]
+          verbs: ["get", "list"]
+        rollouts:
+          enabled: true
+          resources: ["rollouts", "analysisruns", "experiments"]
+          verbs: ["get", "list"]
+        kubexCRDs:
+          enabled: true
+          resources: ["automationstrategies", "clusterautomationstrategies", "clustergpurebalancingpolicies", "clusterproactivepolicies", "clusterrollbackpolicies", "clusterstaticpolicies", "globalconfigurations", "gpuconsolidationpolicies", "gpurebalancingpolicies", "podaffinitypolicies", "policyevaluations", "proactivepolicies", "rollbackpolicies", "staticpolicies"]
+          verbs: ["get", "list"]
+        selfSubjectReview:
+          enabled: true
+          resources: ["selfsubjectrulesreviews", "selfsubjectaccessreviews"]
+          verbs: ["create"]
+    connector:
+      serviceAccount:
+        create: false
+      clusterRole:
+        create: false
+      clusterRoleBinding:
+        create: false
+      role:
+        create: false
+      roleBinding:
+        create: false
+      rules: {}
+
 stack:
   densify:
     createSecret: true
@@ -18,6 +88,22 @@ gpu-process-exporter:
 node-labeler:
   enabled: false
 
+kubex-connector:
+  enabled: false
+  extraLabels: {}
+  extraAnnotations: {}
+  forwarderConfigMap:
+    name: kubex-kubex-stack
+  forwarderCredentialsSecretRef:
+    name: densify-api-secret
+
+kubex-ai-cdi:
+  enabled: false
+  extraLabels: {}
+  extraAnnotations: {}
+  rbac:
+    enabled: false
+
 container-optimization-data-forwarder:
   nameOverride: kubex-stack
   tolerations:
@@ -34,6 +120,7 @@ container-optimization-data-forwarder:
       densify:
         url:
           UserSecretName: densify-api-secret
+    clusters: []
     prometheus:
       url:
         host: kubex-prometheus-server

From 4da944a3f8e9fd158d21fd6c5cee66da50303cc7 Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Fri, 3 Jul 2026 15:52:34 -0400
Subject: [PATCH 2/8] fix(chart): clean stack merge follow-ups

---
 charts/kubex-automation-stack/Chart.lock | 1 -
 charts/kubex-automation-stack/README.md  | 3 +--
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/charts/kubex-automation-stack/Chart.lock b/charts/kubex-automation-stack/Chart.lock
index 1bcafbf..4edb74b 100644
--- a/charts/kubex-automation-stack/Chart.lock
+++ b/charts/kubex-automation-stack/Chart.lock
@@ -23,6 +23,5 @@ dependencies:
 - name: node-labeler
   repository: https://densify-dev.github.io/helm-charts
   version: 0.1.2
-<<<<<<< HEAD
 digest: sha256:d4b36dc243779019f4a3277b17c487f1be80c39d5a6ce5a3b40979a42dbc5955
 generated: "2026-07-03T17:48:40.199770372Z"
diff --git a/charts/kubex-automation-stack/README.md b/charts/kubex-automation-stack/README.md
index c9c3244..4c07c4e 100644
--- a/charts/kubex-automation-stack/README.md
+++ b/charts/kubex-automation-stack/README.md
@@ -114,7 +114,6 @@ The following table lists configuration parameters in `values-edit.yaml`.
 | `gpu-process-exporter.enabled`                                                           |                    | Enable GPU process exporter subchart (default: `true`) |
 | `beyla.enabled`                                                           |                    | Enable Grafana Beyla for application runtime detection (default: `true`) |
 | `k8s-ephemeral-storage-metrics.enabled`                                          |                    | Enable ephemeral storage metrics collection (default: `true`) |
-| `node-labeler.enabled`                                                           |                    | Enable optional node-labeler subchart (default: `false`) |
 | `kubex-connector.enabled`                                                        |                    | Enable optional connector subchart (default: `false`) |
 | `kubex-ai-cdi.enabled`                                                           |                    | Enable optional kubex-ai-cdi subchart (default: `false`) |
 | `kubex-connector.heartbeatSeconds`                                               |                    | Connector heartbeat interval in seconds |
@@ -149,7 +148,7 @@ This chart consists of the following subcharts:
   - Additional Kubex-specific grouping labels are needed beyond cloud provider labels
   - Enhanced node group visibility is desired in OpenShift environments (leverages Machine API)
 
-* [Kubex Connector](../kubex-ai-connector) - Optional in-cluster connector used for the cluster data interface.
+* [Kubex Connector](../kubex-connector) - Optional in-cluster connector used for the cluster data interface.
 
 * [kubex-ai-cdi](../kubex-ai-cdi) - Optional in-cluster Kubex cluster data interface service.
 

From c8be341f0c4a2d9a2f1f96bff7f73c59f36ded34 Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Fri, 3 Jul 2026 16:03:19 -0400
Subject: [PATCH 3/8] docs(chart): bump stack release metadata

---
 charts/kubex-automation-stack/CHANGELOG.md    | 14 ++++
 charts/kubex-automation-stack/Chart.yaml      |  2 +-
 charts/kubex-automation-stack/README.md       |  4 +-
 .../kubex-automation-stack/docs/RBAC-Guide.md | 78 +++++++++++++++++++
 4 files changed, 96 insertions(+), 2 deletions(-)
 create mode 100644 charts/kubex-automation-stack/docs/RBAC-Guide.md

diff --git a/charts/kubex-automation-stack/CHANGELOG.md b/charts/kubex-automation-stack/CHANGELOG.md
index 616c29a..4ee42a2 100644
--- a/charts/kubex-automation-stack/CHANGELOG.md
+++ b/charts/kubex-automation-stack/CHANGELOG.md
@@ -2,6 +2,20 @@
 
 All notable changes to the kubex-automation-stack chart will be documented in this file.
 
+## [1.0.19] - 2026-07-03
+
+### Added
+- Added optional `kubex-connector` and `kubex-ai-cdi` subchart support to the stack
+- Added stack-managed CDI service account, ClusterRole, and ClusterRoleBinding templates
+- Added forwarder `ConfigMap` keys for shared Kubex host, tenant, and cluster name consumption
+
+### Changed
+- Switched stack-managed connector tunnel wiring to `/tunnel/connect`
+- Documented stack-managed connector/CDI configuration and RBAC behavior
+
+### Fixed
+- Disabled the forwarder hook job in the OpenShift overlay so the cron-based collector path is used consistently
+- Added OpenShift security context defaults for stack-managed connector and CDI deployments
 
 ## [1.0.17] - 2026-06-23
 
diff --git a/charts/kubex-automation-stack/Chart.yaml b/charts/kubex-automation-stack/Chart.yaml
index facfaa9..0c48ee9 100644
--- a/charts/kubex-automation-stack/Chart.yaml
+++ b/charts/kubex-automation-stack/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 description: Kubex Collection Stack
 name: kubex-automation-stack
-version: 1.0.18
+version: 1.0.19
 type: application
 icon: https://kubex.ai/wp-content/uploads/kubex-logo-landscape.svg
 dependencies:
diff --git a/charts/kubex-automation-stack/README.md b/charts/kubex-automation-stack/README.md
index 4c07c4e..26de803 100644
--- a/charts/kubex-automation-stack/README.md
+++ b/charts/kubex-automation-stack/README.md
@@ -114,6 +114,7 @@ The following table lists configuration parameters in `values-edit.yaml`.
 | `gpu-process-exporter.enabled`                                                           |                    | Enable GPU process exporter subchart (default: `true`) |
 | `beyla.enabled`                                                           |                    | Enable Grafana Beyla for application runtime detection (default: `true`) |
 | `k8s-ephemeral-storage-metrics.enabled`                                          |                    | Enable ephemeral storage metrics collection (default: `true`) |
+| `node-labeler.enabled`                                                           |                    | Enable optional node-labeler subchart to add Kubex Node Group labels to nodes; useful when nodes lack standard cloud provider node pool/group labels (default: `false`) |
 | `kubex-connector.enabled`                                                        |                    | Enable optional connector subchart (default: `false`) |
 | `kubex-ai-cdi.enabled`                                                           |                    | Enable optional kubex-ai-cdi subchart (default: `false`) |
 | `kubex-connector.heartbeatSeconds`                                               |                    | Connector heartbeat interval in seconds |
@@ -122,7 +123,8 @@ The following table lists configuration parameters in `values-edit.yaml`.
 Connector and CDI use the shared Kubex host and cluster entered under `container-optimization-data-forwarder.config.*`. The forwarder publishes those runtime values in its `ConfigMap`, and the connector consumes them through `forwarderConfigMap.name`. Credentials come from `stack.densify` through `densify-api-secret`, which the connector consumes through `forwarderCredentialsSecretRef.name` by default. The stack chart also owns the CDI service account and RBAC by rendering those manifests itself while disabling `kubex-ai-cdi.rbac.enabled` in the subchart.
 
 For the full stack RBAC shape and defaults, refer to `charts/kubex-automation-stack/values.yaml`.
-| `node-labeler.enabled`                                                           |                    | Enable optional node-labeler subchart to add Kubex Node Group labels to nodes; useful when nodes lack standard cloud provider pool/group labels (default: `false`) |
+
+For a guided explanation of the stack-managed CDI RBAC model, see [docs/RBAC-Guide.md](docs/RBAC-Guide.md).
 
 ## Limitations
 
diff --git a/charts/kubex-automation-stack/docs/RBAC-Guide.md b/charts/kubex-automation-stack/docs/RBAC-Guide.md
new file mode 100644
index 0000000..df16592
--- /dev/null
+++ b/charts/kubex-automation-stack/docs/RBAC-Guide.md
@@ -0,0 +1,78 @@
+# RBAC Guide
+
+This guide explains the RBAC model used by `kubex-automation-stack` for the optional connector and CDI components.
+
+## Overview
+
+When `kubex-connector.enabled=true` and `kubex-ai-cdi.enabled=true`, the stack deploys:
+
+- the in-cluster connector used for tunnel-based access
+- the in-cluster CDI service used to expose cluster data
+- stack-managed CDI RBAC resources
+
+The stack keeps CDI RBAC ownership at the umbrella chart layer and disables subchart RBAC with `kubex-ai-cdi.rbac.enabled=false`.
+
+## CDI RBAC Ownership
+
+The stack renders these resources directly:
+
+- `ServiceAccount/kubex-ai-cdi-sa`
+- `ClusterRole/kubex-ai-cdi-reader`
+- `ClusterRoleBinding/kubex-ai-cdi-reader`
+
+Those resources are controlled through `rbac.permissions.cdi.*` in `values.yaml`.
+
+## Default CDI Permissions
+
+By default, the stack grants CDI read access to the cluster resources needed for cluster data interface behavior, including:
+
+- core resources: `pods`, `services`, `configmaps`, `namespaces`, `nodes`, `events`
+- pod logs: `pods/log`
+- workloads: `deployments`, `daemonsets`, `statefulsets`, `replicasets`
+- rollout APIs: `rollouts`, `analysisruns`, `experiments`
+- Kubex rightsizing CRDs
+- self-subject review APIs for capability discovery
+
+The default rule set also includes optional integrations for:
+
+- OpenShift Machine API resources when `openshift.enabled=true`
+- Karpenter resources
+- Karpenter AWS node class resources
+
+## Connector RBAC
+
+The connector itself does not create RBAC resources in the stack. It consumes runtime identity from the forwarder `ConfigMap` and credentials from `densify-api-secret` through `forwarderCredentialsSecretRef`.
+
+The stack leaves `rbac.permissions.connector.*` disabled by default because the connector currently does not require additional Kubernetes API permissions for its tunnel role.
+
+## Runtime Wiring
+
+The stack-managed connector and CDI share cluster identity from the forwarder-generated `ConfigMap`:
+
+- `kubex_host`
+- `kubex_tenant_id`
+- `kubex_cluster_name`
+
+The connector uses those values to derive:
+
+- `CONNECTOR_PROXY_WS_URL`
+- `CONNECTOR_TENANT_ID`
+- `CONNECTOR_CLUSTER_ID`
+- `RELAY_UPSTREAM_WSS_URL`
+- `DENSIFY_BASE_URL`
+
+## Validation
+
+Useful checks after install:
+
+```bash
+kubectl -n kubex get serviceaccount kubex-ai-cdi-sa
+kubectl get clusterrole kubex-ai-cdi-reader
+kubectl get clusterrolebinding kubex-ai-cdi-reader
+kubectl auth can-i --list --as=system:serviceaccount:kubex:kubex-ai-cdi-sa
+kubectl -n kubex get configmap kubex-kubex-stack -o yaml
+```
+
+## OpenShift Note
+
+For OpenShift installs, use `values-openshift.yaml` so the stack-managed connector and CDI receive compatible security context defaults.

From 94d7b6e4dc5fb8b04fcdf5bb8031ad93c6cc1e89 Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Wed, 8 Jul 2026 11:46:25 -0400
Subject: [PATCH 4/8] fix(chart): clean stack helper and overlays

---
 .../kubex-automation-stack/templates/_helpers.tpl  | 13 -------------
 .../templates/kubex-ai-cdi-clusterrolebinding.yaml |  5 +++--
 charts/kubex-automation-stack/values-edit.yaml     | 14 +++++---------
 .../kubex-automation-stack/values-openshift.yaml   |  8 --------
 4 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/charts/kubex-automation-stack/templates/_helpers.tpl b/charts/kubex-automation-stack/templates/_helpers.tpl
index 9f9c4d4..fbceba1 100644
--- a/charts/kubex-automation-stack/templates/_helpers.tpl
+++ b/charts/kubex-automation-stack/templates/_helpers.tpl
@@ -1,19 +1,6 @@
 {{- define "common.namespace" -}}
   {{- default .Release.Namespace .Values.nsPrefix -}}
 {{- end -}}
-{{- define "common.kubexHost" -}}
-{{- $forwarder := index .Values "container-optimization-data-forwarder" | default dict -}}
-{{- $config := $forwarder.config | default dict -}}
-{{- $densify := $config.forwarder.densify | default dict -}}
-{{- $url := $densify.url | default dict -}}
-{{- trim (default "" $url.host) -}}
-{{- end -}}
-{{- define "common.kubexClusters" -}}
-{{- $forwarder := index .Values "container-optimization-data-forwarder" | default dict -}}
-{{- $config := $forwarder.config | default dict -}}
-{{- $clusters := $config.clusters | default list -}}
-{{- toYaml $clusters -}}
-{{- end -}}
 {{- define "common.checkValues" -}}
 {{- $openshiftEnabled := .Values.openshift.enabled -}}
 {{- $deployPrometheus := .Values.stack.prometheus.deploy -}}
diff --git a/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml b/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml
index 7fb55d4..01ade7f 100644
--- a/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml
+++ b/charts/kubex-automation-stack/templates/kubex-ai-cdi-clusterrolebinding.yaml
@@ -1,16 +1,17 @@
 {{- $rbac := .Values.rbac | default dict -}}
 {{- $cdi := $rbac.permissions.cdi | default dict -}}
 {{- $clusterRole := $cdi.clusterRole | default dict -}}
+{{- $clusterRoleBinding := $cdi.clusterRoleBinding | default dict -}}
 {{- $serviceAccount := $cdi.serviceAccount | default dict -}}
 {{- $cdiValues := index .Values "kubex-ai-cdi" | default dict -}}
 {{- $cdiRbac := $cdiValues.rbac | default dict -}}
 {{- $extraLabels := $cdiValues.extraLabels | default dict -}}
 {{- $extraAnnotations := $cdiValues.extraAnnotations | default dict -}}
-{{- if and $cdiValues.enabled $rbac.create (not ($cdiRbac.enabled | default false)) (dig "create" false $clusterRole) }}
+{{- if and $cdiValues.enabled $rbac.create (not ($cdiRbac.enabled | default false)) (dig "create" false $clusterRoleBinding) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ default "kubex-ai-cdi-reader" (dig "name" "" $clusterRole) }}
+  name: {{ default "kubex-ai-cdi-reader" (dig "name" "" $clusterRoleBinding) }}
   labels:
     app: kubex-ai-cdi
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
diff --git a/charts/kubex-automation-stack/values-edit.yaml b/charts/kubex-automation-stack/values-edit.yaml
index b4842f1..8e70a4e 100644
--- a/charts/kubex-automation-stack/values-edit.yaml
+++ b/charts/kubex-automation-stack/values-edit.yaml
@@ -21,24 +21,20 @@ container-optimization-data-forwarder:
 # Keep these opt-in until the feature is generally available in production.
 # kubex-connector:
 #   enabled: true
-#
 # kubex-ai-cdi:
 #   enabled: true
-
-#   Optional: Additional labels inherited by CDI resources
 #   extraLabels:
 #     my-custom-label: my-value-1
-#   Optional: Additional annotations inherited by CDI resources
 #   extraAnnotations:
 #     my-custom-annotation: my-value-2
 
 # The following values are optional, if job cleanup is required;
 # each one of these should be a non-negative integer (0 is allowed)
-  # cronJob:
-    # successfulJobsHistoryLimit: <value>
-    # failedJobsHistoryLimit: <value>
-    # ttlSecondsAfterFinished: <value> # applies for both the cronjob and the job
-    # backoffLimit: <value> # applies for both the cronjob and the job, default: 4
+# cronJob:
+#   successfulJobsHistoryLimit: <value>
+#   failedJobsHistoryLimit: <value>
+#   ttlSecondsAfterFinished: <value> # applies for both the cronjob and the job
+#   backoffLimit: <value> # applies for both the cronjob and the job, default: 4
 
 # The following section is optional, and is required only in the following use-case:
 # 1. The persistent volume for Prometheus has to use an explicit storage class (not the default)
diff --git a/charts/kubex-automation-stack/values-openshift.yaml b/charts/kubex-automation-stack/values-openshift.yaml
index 759661f..70e3740 100644
--- a/charts/kubex-automation-stack/values-openshift.yaml
+++ b/charts/kubex-automation-stack/values-openshift.yaml
@@ -39,10 +39,6 @@ k8s-ephemeral-storage-metrics:
     scrapeTimeout: 10s
 
 kubex-connector:
-  securityContext:
-    runAsUser: 1000750000
-    runAsGroup: 1000750000
-    fsGroup: 1000750000
   containerSecurityContext:
     capabilities:
       drop:
@@ -51,10 +47,6 @@ kubex-connector:
       type: RuntimeDefault
 
 kubex-ai-cdi:
-  securityContext:
-    runAsUser: 1000750000
-    runAsGroup: 1000750000
-    fsGroup: 1000750000
   containerSecurityContext:
     capabilities:
       drop:

From 27895cd59fa29baf702a7957837e4351d36bd013 Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Wed, 24 Jun 2026 14:23:39 -0400
Subject: [PATCH 5/8] feat(chart): restore automation stack changes

---
 charts/kubex-automation-stack/Chart.yaml  | 4 ++--
 charts/kubex-automation-stack/values.yaml | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/charts/kubex-automation-stack/Chart.yaml b/charts/kubex-automation-stack/Chart.yaml
index 0c48ee9..6740e85 100644
--- a/charts/kubex-automation-stack/Chart.yaml
+++ b/charts/kubex-automation-stack/Chart.yaml
@@ -9,11 +9,11 @@ dependencies:
     version: "4.*.*"
     repository: https://densify-dev.github.io/helm-charts
   - name: kubex-connector
-    version: "0.1.*"
+    version: "1.*.*"
     repository: https://densify-dev.github.io/helm-charts
     condition: kubex-connector.enabled
   - name: kubex-ai-cdi
-    version: "0.1.*"
+    version: "1.*.*"
     repository: https://densify-dev.github.io/helm-charts
     condition: kubex-ai-cdi.enabled
   - name: prometheus
diff --git a/charts/kubex-automation-stack/values.yaml b/charts/kubex-automation-stack/values.yaml
index 4b293d1..ced1299 100644
--- a/charts/kubex-automation-stack/values.yaml
+++ b/charts/kubex-automation-stack/values.yaml
@@ -92,6 +92,8 @@ kubex-connector:
   enabled: false
   extraLabels: {}
   extraAnnotations: {}
+  image:
+    tag: 0.1.9-rc.3
   forwarderConfigMap:
     name: kubex-kubex-stack
   forwarderCredentialsSecretRef:
@@ -101,6 +103,8 @@ kubex-ai-cdi:
   enabled: false
   extraLabels: {}
   extraAnnotations: {}
+  image:
+    tag: 0.1.9-rc.3
   rbac:
     enabled: false
 

From 86a17b99078c0cf9dd031b972b0a1edf8d87cd0a Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Mon, 20 Jul 2026 10:20:29 -0400
Subject: [PATCH 6/8] feat(chart): sync connector and cdi public charts

---
 charts/kubex-ai-cdi/Chart.yaml                |  6 ++---
 charts/kubex-ai-cdi/values.yaml               |  2 +-
 charts/kubex-automation-stack/Chart.lock      | 14 +++++------
 charts/kubex-automation-stack/Chart.yaml      |  4 +--
 .../templates/kubex-connector-configmap.yaml  | 25 +++++++++++++++++++
 charts/kubex-automation-stack/values.yaml     |  2 +-
 charts/kubex-connector/Chart.yaml             |  6 ++---
 charts/kubex-connector/values.yaml            |  2 +-
 8 files changed, 43 insertions(+), 18 deletions(-)
 create mode 100644 charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml

diff --git a/charts/kubex-ai-cdi/Chart.yaml b/charts/kubex-ai-cdi/Chart.yaml
index 4c367af..5342320 100644
--- a/charts/kubex-ai-cdi/Chart.yaml
+++ b/charts/kubex-ai-cdi/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: kubex-ai-cdi
 description: In-cluster Kubex cluster data interface service exposed over HTTP
 type: application
-version: 0.1.8
+version: 0.1.9-rc.3
 icon: https://kubex.ai/wp-content/uploads/kubex-logo-landscape.svg
 maintainers:
-- email: support@kubex.ai
-  name: support
+  - email: support@kubex.ai
+    name: support
diff --git a/charts/kubex-ai-cdi/values.yaml b/charts/kubex-ai-cdi/values.yaml
index 14feb49..60eea2a 100644
--- a/charts/kubex-ai-cdi/values.yaml
+++ b/charts/kubex-ai-cdi/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: densify/kubex-ai-cdi
-  tag: 0.1.8
+  tag: 0.1.9-rc.3
   pullPolicy: IfNotPresent
 
 replicaCount: 1
diff --git a/charts/kubex-automation-stack/Chart.lock b/charts/kubex-automation-stack/Chart.lock
index 4edb74b..874af2c 100644
--- a/charts/kubex-automation-stack/Chart.lock
+++ b/charts/kubex-automation-stack/Chart.lock
@@ -4,24 +4,24 @@ dependencies:
   version: 4.0.17
 - name: kubex-connector
   repository: https://densify-dev.github.io/helm-charts
-  version: 0.1.7
+  version: 0.1.8
 - name: kubex-ai-cdi
   repository: https://densify-dev.github.io/helm-charts
-  version: 0.1.7
+  version: 0.1.8
 - name: prometheus
   repository: https://prometheus-community.github.io/helm-charts
-  version: 29.14.0
+  version: 29.17.0
 - name: beyla
   repository: https://grafana.github.io/helm-charts
-  version: 1.16.8
+  version: 1.16.10
 - name: k8s-ephemeral-storage-metrics
   repository: https://densify-dev.github.io/helm-charts
   version: 1.21.0
 - name: gpu-process-exporter
   repository: https://densify-dev.github.io/helm-charts
-  version: 1.0.0
+  version: 1.1.0
 - name: node-labeler
   repository: https://densify-dev.github.io/helm-charts
   version: 0.1.2
-digest: sha256:d4b36dc243779019f4a3277b17c487f1be80c39d5a6ce5a3b40979a42dbc5955
-generated: "2026-07-03T17:48:40.199770372Z"
+digest: sha256:462fdc738b2cabfb00741487e2f519838d81ffc3c094d9662eb237b284f0108d
+generated: "2026-07-17T16:01:39.083440872-04:00"
diff --git a/charts/kubex-automation-stack/Chart.yaml b/charts/kubex-automation-stack/Chart.yaml
index 6740e85..0c48ee9 100644
--- a/charts/kubex-automation-stack/Chart.yaml
+++ b/charts/kubex-automation-stack/Chart.yaml
@@ -9,11 +9,11 @@ dependencies:
     version: "4.*.*"
     repository: https://densify-dev.github.io/helm-charts
   - name: kubex-connector
-    version: "1.*.*"
+    version: "0.1.*"
     repository: https://densify-dev.github.io/helm-charts
     condition: kubex-connector.enabled
   - name: kubex-ai-cdi
-    version: "1.*.*"
+    version: "0.1.*"
     repository: https://densify-dev.github.io/helm-charts
     condition: kubex-ai-cdi.enabled
   - name: prometheus
diff --git a/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml b/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml
new file mode 100644
index 0000000..87b3756
--- /dev/null
+++ b/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml
@@ -0,0 +1,25 @@
+{{- $connectorValues := index .Values "kubex-connector" | default dict -}}
+{{- $enabled := $connectorValues.enabled | default false -}}
+{{- if $enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kubex-connector-runtime
+  namespace: {{ template "common.namespace" . }}
+  labels:
+    app: kubex-connector
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- with $connectorValues.extraLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with $connectorValues.extraAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  kubex_host: {{ include "common.kubexHost" . | quote }}
+  kubex_tenant_id: {{ (index (splitList "." (include "common.kubexHost" .)) 0) | quote }}
+  kubex_cluster_name: {{ ((first (fromYamlArray (include "common.kubexClusters" .))).name) | quote }}
+{{- end }}
diff --git a/charts/kubex-automation-stack/values.yaml b/charts/kubex-automation-stack/values.yaml
index ced1299..c83b31f 100644
--- a/charts/kubex-automation-stack/values.yaml
+++ b/charts/kubex-automation-stack/values.yaml
@@ -95,7 +95,7 @@ kubex-connector:
   image:
     tag: 0.1.9-rc.3
   forwarderConfigMap:
-    name: kubex-kubex-stack
+    name: kubex-connector-runtime
   forwarderCredentialsSecretRef:
     name: densify-api-secret
 
diff --git a/charts/kubex-connector/Chart.yaml b/charts/kubex-connector/Chart.yaml
index d5577d1..b3af8e5 100644
--- a/charts/kubex-connector/Chart.yaml
+++ b/charts/kubex-connector/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: kubex-connector
 description: Stack-managed in-cluster connector used for the cluster data interface
 type: application
-version: 0.1.8
+version: 0.1.9-rc.3
 icon: https://kubex.ai/wp-content/uploads/kubex-logo-landscape.svg
 maintainers:
-- email: support@kubex.ai
-  name: support
+  - email: support@kubex.ai
+    name: support
diff --git a/charts/kubex-connector/values.yaml b/charts/kubex-connector/values.yaml
index db1972f..90ee54a 100644
--- a/charts/kubex-connector/values.yaml
+++ b/charts/kubex-connector/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: densify/kubex-connector
-  tag: 0.1.8
+  tag: 0.1.9-rc.3
   pullPolicy: IfNotPresent
 
 replicaCount: 1

From ca97e5876ca4d33644b6a7a8509d35848d72a114 Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Mon, 20 Jul 2026 10:24:41 -0400
Subject: [PATCH 7/8] fix(chart): wire stack connector runtime config

---
 .../templates/kubex-connector-configmap.yaml    | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml b/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml
index 87b3756..36c7b20 100644
--- a/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml
+++ b/charts/kubex-automation-stack/templates/kubex-connector-configmap.yaml
@@ -1,5 +1,16 @@
 {{- $connectorValues := index .Values "kubex-connector" | default dict -}}
 {{- $enabled := $connectorValues.enabled | default false -}}
+{{- $forwarder := index .Values "container-optimization-data-forwarder" | default dict -}}
+{{- $config := $forwarder.config | default dict -}}
+{{- $forwarderConfig := $config.forwarder | default dict -}}
+{{- $densify := $forwarderConfig.densify | default dict -}}
+{{- $url := $densify.url | default dict -}}
+{{- $host := trim (default "" $url.host) -}}
+{{- $clusters := $config.clusters | default list -}}
+{{- $cluster := dict -}}
+{{- if gt (len $clusters) 0 -}}
+{{- $cluster = first $clusters -}}
+{{- end -}}
 {{- if $enabled }}
 apiVersion: v1
 kind: ConfigMap
@@ -19,7 +30,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:
-  kubex_host: {{ include "common.kubexHost" . | quote }}
-  kubex_tenant_id: {{ (index (splitList "." (include "common.kubexHost" .)) 0) | quote }}
-  kubex_cluster_name: {{ ((first (fromYamlArray (include "common.kubexClusters" .))).name) | quote }}
+  kubex_host: {{ $host | quote }}
+  kubex_tenant_id: {{ (index (splitList "." $host) 0) | quote }}
+  kubex_cluster_name: {{ (default "" $cluster.name) | quote }}
 {{- end }}

From ed26c5037f072eb7e8a36ec3d40cbbf8a4ce5bec Mon Sep 17 00:00:00 2001
From: Geoffrey Asare <gasare@kubex.ai>
Date: Tue, 21 Jul 2026 20:17:47 +0000
Subject: [PATCH 8/8] chore: add Kubex AI chart code owners

---
 .github/CODEOWNERS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 695916a..1c07307 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,2 +1,6 @@
 # Default owner for everything in the repo
 * @densify-dev/cluster-kit
+
+# Kubex AI charts
+/charts/kubex-connector/ @gasarekubex @shsma
+/charts/kubex-ai-cdi/ @gasarekubex @shsma