diff --git a/README.md b/README.md
index 6d7856c..7480093 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ Also automated when enabled in `terraform.tfvars`:
 - Downstream registration into Rancher
 - Official **TrueNAS CSI** (NFS) on app clusters
 - **Envoy Gateway** + **kube-vip** LoadBalancer IPs on app clusters
-- Operators: CloudNativePG, MongoDB Community, OpenSearch, GitHub ARC
+- Operators: CloudNativePG (MongoDB Community, OpenSearch and GitHub ARC were removed on 2026-10-05)
 - Optional **Palworld operator** (default: **prd-apps** only)
 
 Topology detail: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
@@ -102,7 +102,7 @@ Full walkthrough: [docs/DEPLOYMENT_GUIDE.md](docs/DEPLOYMENT_GUIDE.md).
 
 ```
 ├── Makefile                 # init / plan / apply / destroy helpers
-├── scripts/                 # apply.sh, destroy.sh, CSI/ARC helpers
+├── scripts/                 # apply.sh, destroy.sh, CSI helpers
 ├── docs/                    # guides + assets/
 ├── examples/                # reference diagrams (e.g. homelab topology)
 ├── helm-values/             # examples (generated values are gitignored)
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 353dc4e..fbbe86e 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -34,7 +34,7 @@ IPs, VLANs, storage, and sizing come from the `clusters` map in `terraform.tfvar
 3. Join manager-2/3; verify cluster; optionally install cert-manager + Rancher.
 4. Create each apps cluster the same way (primary → token → additional servers → workers).
 5. Register downstream clusters with Rancher (when `register_downstream_cluster = true`).
-6. Install platform add-ons on apps clusters when flags are set (CSI, Envoy Gateway, kube-vip, CNPG, MongoDB, OpenSearch, GitHub ARC, Palworld operator).
+6. Install platform add-ons on apps clusters when flags are set (CSI, Envoy Gateway, kube-vip, CNPG, Palworld operator).
 
 RKE2 version comes from `rke2_version` (default `v1.36.2+rke2r1`) and the Rancher chart from `rancher_version` (default `v2.15.0`); both live clusters and defaults match as of 2026-10. Upgrades: [UPGRADE_PLAN.md](UPGRADE_PLAN.md).
 
@@ -69,9 +69,6 @@ Enabled via Terraform flags / versions in tfvars:
 | Component | Notes |
 |-----------|--------|
 | CloudNativePG | PostgreSQL operator on apps clusters |
-| MongoDB Community Operator | For charts that need MongoDB CRs |
-| OpenSearch Operator | Search / logging stacks |
-| GitHub ARC | Actions runners (see [GITHUB_ARC_SETUP.md](GITHUB_ARC_SETUP.md)) |
 | Palworld operator | Manifests from Harbor; **default on prd-apps only** (`install_palworld_operator_prd`) |
 
 ## Terraform layout
diff --git a/docs/GITHUB_ARC_SETUP.md b/docs/GITHUB_ARC_SETUP.md
index 9a86ccd..b1c0d01 100644
--- a/docs/GITHUB_ARC_SETUP.md
+++ b/docs/GITHUB_ARC_SETUP.md
@@ -1,612 +1,11 @@
-# GitHub Actions Runner Controller (ARC) Setup Guide
+# GitHub Actions Runner Controller (ARC): retired
 
-**Last Updated**: January 2025
+ARC was removed from all apps clusters on 2026-10-05. No runner scale sets were ever wired up
+(zero `AutoscalingRunnerSet`, `EphemeralRunnerSet` or legacy `RunnerDeployment` objects on any
+cluster), so the controller, its CRDs, the `actions-runner-system` namespace, the Terraform
+`deploy_arc_*` resources and the GitHub App helper scripts were deleted. CI runs on the GitLab
+runner (`gitops-tools` `gitlab-runner` overlay, nprd-apps).
 
-Complete guide to setting up the **Official GitHub-Supported Actions Runner Controller (ARC)** with Rancher Fleet on downstream clusters.
-
-## Overview
-
-The GitHub Actions Runner Controller (ARC) enables you to run self-hosted GitHub Actions runners in your Kubernetes clusters. This guide covers:
-
-1. **Installation** - Installing the ARC controller and CRDs
-2. **Secret Configuration** - Setting up GitHub authentication
-3. **Fleet Integration** - Managing runners via Rancher Fleet
-4. **Troubleshooting** - Common issues and solutions
-
-## Table of Contents
-
-1. [ARC Version Information](#arc-version-information)
-2. [Installation](#installation)
-3. [Secret Configuration](#secret-configuration)
-4. [Fleet Integration](#fleet-integration)
-5. [Troubleshooting](#troubleshooting)
-6. [Verification](#verification)
-
-## ARC Version Information
-
-### Official ARC (gha-runner-scale-set) ✅ **CURRENT**
-
-We use the **Official GitHub-Supported ARC**:
-
-- **Maintainer**: GitHub (official support)
-- **CRDs**: `AutoscalingRunnerSet`, `EphemeralRunnerSet`, `EphemeralRunner`
-- **API Group**: `actions.github.com/v1alpha1`
-- **Chart**: `oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller`
-- **Release Name**: `gha-runner-scale-set-controller`
-- **Documentation**: https://docs.github.com/en/actions/tutorials/use-actions-runner-controller
-
-**Pros**:
-- ✅ Officially supported by GitHub
-- ✅ Better runner group support
-- ✅ More efficient scaling (ephemeral runners)
-- ✅ Better resource utilization
-- ✅ Active development by GitHub
-
-### Legacy ARC (actions-runner-controller) - **DEPRECATED**
-
-- **Maintainer**: Community (summerwind)
-- **CRDs**: `RunnerDeployment`, `HorizontalRunnerAutoscaler`, `RunnerSet`
-- **API Group**: `actions.summerwind.dev/v1alpha1`
-- **Status**: Still maintained but not officially supported by GitHub
-
-**Note**: If migrating from legacy, update Fleet resources from `RunnerDeployment` to `AutoscalingRunnerSet`.
-
-## Installation
-
-### Prerequisites
-
-- Kubernetes cluster (RKE2) with kubectl access
-- Helm 3.x installed
-- GitHub organization or repository access
-- GitHub App or Personal Access Token (PAT)
-
-### Method 1: Install via Script (Recommended)
-
-```bash
-# Install on nprd-apps cluster
-./scripts/install-github-arc.sh nprd-apps
-
-# Install on prd-apps cluster
-./scripts/install-github-arc.sh prd-apps
-
-# Install on poc-apps cluster
-./scripts/install-github-arc.sh poc-apps
-```
-
-### Method 2: Install via Helm (Manual)
-
-```bash
-# Set kubeconfig
-export KUBECONFIG=~/.kube/nprd-apps.yaml
-
-# Install official ARC controller
-helm install gha-runner-scale-set-controller \
-  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller \
-  --namespace actions-runner-system \
-  --create-namespace \
-  --wait
-
-# Verify installation
-kubectl get pods -n actions-runner-system
-kubectl get crd | grep -E "autoscalingrunnerset|ephemeralrunner"
-```
-
-### Method 3: Install via Terraform (Automated)
-
-The ARC controller can be automatically installed via Terraform. Check `terraform/main.tf` for:
-- `null_resource.deploy_arc_nprd_apps`
-- `null_resource.deploy_arc_prd_apps`
-- `null_resource.deploy_arc_poc_apps`
-
-The controller is automatically installed when you run `terraform apply`.
-
-### Verify CRDs Installed
-
-The CRDs are installed immediately when Helm installs the chart. Verify:
-
-```bash
-kubectl get crd | grep -E "autoscalingrunnerset|ephemeralrunner"
-
-# Should show:
-# - autoscalingrunnersets.actions.github.com
-# - ephemeralrunnersets.actions.github.com
-# - ephemeralrunners.actions.github.com
-```
-
-**Important**: Fleet can validate runner resources as soon as CRDs exist, even if the controller pod is still starting.
-
-## Secret Configuration
-
-The ARC controller requires GitHub authentication at **two levels**:
-
-1. **Controller Secret** (`controller-manager` in `actions-runner-system`) - For the controller to manage runner scale sets
-2. **Runner Scale Set Secret** (referenced by `AutoscalingRunnerSet` via `githubConfigSecret`) - For the runner scale set to authenticate with GitHub
-
-### Helper Scripts
-
-We provide helper scripts to automate secret creation:
-
-#### Interactive Setup Script (Recommended)
-
-```bash
-# Interactive guide through GitHub App creation and secret setup
-./scripts/setup-github-app-arc.sh
-```
-
-This script will:
-- Guide you through creating the GitHub App via web interface
-- Collect App ID, Installation ID, and private key path
-- Automatically create Kubernetes secrets for your cluster(s)
-
-#### Direct Secret Creation Script
-
-```bash
-# Create secrets directly (if you already have app details)
-./scripts/create-github-app-secrets.sh \
-  -c nprd-apps \
-  -i YOUR_APP_ID \
-  -n YOUR_INSTALLATION_ID \
-  -k /path/to/private-key.pem
-```
-
-#### List Existing Apps
-
-```bash
-# View GitHub Apps (opens web interface)
-./scripts/list-github-apps.sh
-```
-
-### Authentication Methods
-
-ARC supports two authentication methods for both secrets:
-
-#### Method 1: GitHub Personal Access Token (PAT) - For Testing
-
-**Use for**: Development/testing environments, quick setup
-
-**Pros**:
-- Simple setup (just one token)
-- Quick to configure
-
-**Cons**:
-- Less secure (broad permissions)
-- User account dependency
-- Can expire if account is inactive
-- Not recommended for production
-
-##### Controller Secret (PAT)
-
-```bash
-# For nprd-apps
-kubectl --kubeconfig ~/.kube/nprd-apps.yaml create secret generic controller-manager \
-  -n actions-runner-system \
-  --from-literal=github_token="YOUR_GITHUB_TOKEN" \
-  --dry-run=client -o yaml | kubectl apply -f -
-
-# For prd-apps
-kubectl --kubeconfig ~/.kube/prd-apps.yaml create secret generic controller-manager \
-  -n actions-runner-system \
-  --from-literal=github_token="YOUR_GITHUB_TOKEN" \
-  --dry-run=client -o yaml | kubectl apply -f -
-
-# Restart deployments
-kubectl --kubeconfig ~/.kube/nprd-apps.yaml rollout restart deployment gha-runner-scale-set-controller -n actions-runner-system
-```
-
-##### Runner Scale Set Secret (PAT)
-
-```bash
-# For nprd-apps - Create secret in the runner namespace (e.g., managed-cicd)
-kubectl --kubeconfig ~/.kube/nprd-apps.yaml create secret generic github-app-secret \
-  -n managed-cicd \
-  --from-literal=github_token="YOUR_GITHUB_TOKEN" \
-  --dry-run=client -o yaml | kubectl apply -f -
-```
-
-**Note**: The `AutoscalingRunnerSet` resource must reference this secret:
-```yaml
-spec:
-  githubConfigSecret: github-app-secret  # Name of the secret
-```
-
-#### Method 2: GitHub App Authentication - **Recommended for Production** ✅
-
-**Use for**: Production environments, organizations, security-sensitive setups
-
-**Pros**:
-- ✅ More secure (scoped permissions)
-- ✅ No user account dependency
-- ✅ Fine-grained permissions
-- ✅ Better audit trail
-- ✅ Official GitHub recommendation
-- ✅ Better runner group support
-
-**Cons**:
-- Slightly more complex setup
-- Requires GitHub App creation
-
-##### Step 1: Create a GitHub App
-
-1. Go to your organization → **Settings** → **Developer settings** → **GitHub Apps**
-2. **Check existing apps** (to avoid name conflicts): https://github.com/organizations/YOUR_ORG/settings/apps
-3. Click **New GitHub App**
-4. Configure the app:
-   - **Name**: Must be unique across all GitHub. Try:
-     - `arc-runner-controller-{org-name}` (e.g., `arc-runner-controller-dataknifeai`)
-     - `arc-runner-controller-{date}` (e.g., `arc-runner-controller-20260109`)
-     - `arc-runner-controller-{org}-{env}` (e.g., `arc-runner-controller-dataknifeai-nprd`)
-   - **Homepage URL**: Your organization URL (e.g., `https://github.com/DataKnifeAI`)
-   - **Webhook**: Unchecked (not required for ARC)
-   - **Permissions**:
-     - **Repository Permissions**:
-       - `Actions`: **Read & Write**
-       - `Metadata`: **Read-only**
-     - **Organization Permissions**:
-       - `Self-hosted runners`: **Read & Write**
-   - **Where can this GitHub App be installed?**: **Only on this account**
-5. Click **Create GitHub App**
-6. **Note the App ID** (visible on the app page, under the app name)
-7. Generate and download the private key:
-   - Scroll down to **Private keys**
-   - Click **Generate a private key**
-   - Save the downloaded `.pem` file securely (you can only download it once!)
-8. Install the app on your organization:
-   - Click **Install App** (in sidebar or top of app page)
-   - Select your organization (e.g., **DataKnifeAI**)
-   - Choose installation permissions (All repositories recommended for ARC)
-   - Click **Install**
-   - **Note the Installation ID** (visible in the URL: `/installations/<INSTALLATION_ID>`)
-
-##### Step 2: Create Controller Secret (GitHub App)
-
-```bash
-# For nprd-apps
-kubectl --kubeconfig ~/.kube/nprd-apps.yaml create secret generic controller-manager \
-  -n actions-runner-system \
-  --from-literal=github_app_id="YOUR_APP_ID" \
-  --from-literal=github_app_installation_id="YOUR_INSTALLATION_ID" \
-  --from-literal=github_app_private_key="$(cat path/to/private-key.pem)" \
-  --dry-run=client -o yaml | kubectl apply -f -
-
-# For prd-apps
-kubectl --kubeconfig ~/.kube/prd-apps.yaml create secret generic controller-manager \
-  -n actions-runner-system \
-  --from-literal=github_app_id="YOUR_APP_ID" \
-  --from-literal=github_app_installation_id="YOUR_INSTALLATION_ID" \
-  --from-literal=github_app_private_key="$(cat path/to/private-key.pem)" \
-  --dry-run=client -o yaml | kubectl apply -f -
-
-# Restart deployments
-kubectl --kubeconfig ~/.kube/nprd-apps.yaml rollout restart deployment gha-runner-scale-set-controller -n actions-runner-system
-kubectl --kubeconfig ~/.kube/prd-apps.yaml rollout restart deployment gha-runner-scale-set-controller -n actions-runner-system
-```
-
-##### Step 3: Create Runner Scale Set Secret (GitHub App)
-
-**Important**: This secret is referenced by the `AutoscalingRunnerSet` resource via `spec.githubConfigSecret`.
-
-```bash
-# For nprd-apps - Create secret in the runner namespace (e.g., managed-cicd)
-kubectl --kubeconfig ~/.kube/nprd-apps.yaml create secret generic github-app-secret \
-  -n managed-cicd \
-  --from-literal=github_app_id="YOUR_APP_ID" \
-  --from-literal=github_app_installation_id="YOUR_INSTALLATION_ID" \
-  --from-literal=github_app_private_key="$(cat path/to/private-key.pem)" \
-  --dry-run=client -o yaml | kubectl apply -f -
-```
-
-**Note**: The `AutoscalingRunnerSet` resource must reference this secret:
-```yaml
-apiVersion: actions.github.com/v1alpha1
-kind: AutoscalingRunnerSet
-metadata:
-  name: nprd-autoscale-runners
-  namespace: managed-cicd
-spec:
-  githubConfigUrl: "https://github.com/DataKnifeAI"  # Organization URL
-  githubConfigSecret: github-app-secret  # Name of the secret created above
-  runnerLabels:
-    - self-hosted
-  # ... rest of configuration
-```
-
-**Same App or Different?**: You can use the same GitHub App for both secrets, or create separate apps for controller and runners. Using the same app is simpler and recommended for most setups.
-
-### Secret Structure
-
-#### Controller Secret (`controller-manager` in `actions-runner-system`)
-
-Can contain:
-- `github_token` - Personal Access Token (optional)
-- `github_app_id` - GitHub App ID (optional)
-- `github_app_installation_id` - Installation ID (optional)
-- `github_app_private_key` - PEM-encoded private key (optional)
-
-**Note**: Only ONE authentication method should be used:
-- Use either `github_token` OR `github_app_*` fields
-- Don't mix both methods
-
-#### Runner Scale Set Secret (`githubConfigSecret` in runner namespace)
-
-**For GitHub App** (recommended):
-- `github_app_id` - GitHub App ID (required)
-- `github_app_installation_id` - Installation ID (required)
-- `github_app_private_key` - PEM-encoded private key (required)
-
-**For Personal Access Token**:
-- `github_token` - Personal Access Token (required)
-
-**Secret Name**: The secret name is specified in the `AutoscalingRunnerSet` resource via `spec.githubConfigSecret` (e.g., `github-app-secret`).
-
-**Namespace**: The secret must be in the same namespace as the `AutoscalingRunnerSet` resource.
-
-## Fleet Integration
-
-### The Fleet Dependency Issue (Resolved)
-
-**Problem**: Fleet processes all resources together and validates them. When Fleet tried to apply `AutoscalingRunnerSet` resources, the CRDs didn't exist yet, causing the bundle to fail.
-
-**Solution**: Install the ARC controller (which includes CRDs) **before** Fleet processes runner resources.
-
-### Recommended Setup
-
-#### Step 1: Install Controller First (One-time)
-
-The controller is automatically installed via Terraform when you deploy clusters. If you need to install manually:
-
-```bash
-# Using the installation script (recommended)
-./scripts/install-github-arc.sh nprd-apps
-
-# Or install manually using OCI chart (official GitHub version)
-helm install gha-runner-scale-set-controller \
-  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller \
-  --namespace actions-runner-system \
-  --create-namespace \
-  --wait
-```
-
-**Important**: The CRDs (`AutoscalingRunnerSet`, `EphemeralRunnerSet`, `EphemeralRunner`) are installed as soon as Helm installs the chart. Fleet can validate resources immediately, even if the controller pod is still starting.
-
-#### Step 2: Configure Fleet GitRepo
-
-Once CRDs are installed, Fleet can now validate runner resources:
-
-```yaml
-apiVersion: fleet.cattle.io/v1alpha1
-kind: GitRepo
-metadata:
-  name: github-arc-runners
-  namespace: fleet-default
-spec:
-  repo: https://github.com/your-org/gitops-repo
-  paths:
-    - arc-runners  # Only runner resources, not controller
-  branch: main
-  targets:
-    - clusterName: nprd-apps
-```
-
-**Note**: Controller is installed via Helm/Terraform, not managed by Fleet. Fleet only manages the runner scale set resources.
-
-#### Step 3: Fleet Manifests Structure
-
-Your GitOps repository should have:
-
-```
-gitops/
-└── arc-runners/     # Runner resources (managed by Fleet)
-    └── autoscaling-runner-set.yaml  # AutoscalingRunnerSet resource
-```
-
-### Runner Resources Example
-
-#### Official ARC (AutoscalingRunnerSet) ✅ **CURRENT**
-
-```yaml
-apiVersion: actions.github.com/v1alpha1
-kind: AutoscalingRunnerSet
-metadata:
-  name: example-runner-scale-set
-  namespace: arc-runners
-spec:
-  githubConfigUrl: "https://github.com/your-org/your-repo"
-  githubConfigSecret: github-config-secret
-  maxRunners: 10
-  minRunners: 0
-  runnerLabels:
-    - self-hosted
-  template:
-    spec:
-      containers:
-      - image: ghcr.io/actions/actions-runner:latest
-        resources:
-          requests:
-            cpu: "500m"
-            memory: "1Gi"
-          limits:
-            cpu: "2"
-            memory: "4Gi"
-```
-
-**Note**: For complete configuration options, see: https://docs.github.com/en/actions/tutorials/use-actions-runner-controller/deploy-runner-scale-sets
-
-### Fleet Dependency Configuration (Advanced)
-
-Use Fleet's dependency mechanism to ensure controller is installed first:
-
-```yaml
-# fleet-controller.yaml
-apiVersion: fleet.cattle.io/v1alpha1
-kind: GitRepo
-metadata:
-  name: arc-controller
-spec:
-  repo: https://github.com/your-org/gitops
-  paths:
-    - arc-controller
-  targets:
-    - clusterName: nprd-apps
-
----
-# fleet-runners.yaml
-apiVersion: fleet.cattle.io/v1alpha1
-kind: GitRepo
-metadata:
-  name: arc-runners
-spec:
-  repo: https://github.com/your-org/gitops
-  paths:
-    - arc-runners
-  dependsOn:
-    - name: arc-controller
-  targets:
-    - clusterName: nprd-apps
-```
-
-## Troubleshooting
-
-### Controller Pod Stuck in CrashLoopBackOff
-
-**Symptom**: Controller pods show `CrashLoopBackOff` with authentication errors
-
-**Solution**: Update secret with valid GitHub credentials (see [Secret Configuration](#secret-configuration) section)
-
-```bash
-# Check controller logs
-kubectl logs -n actions-runner-system -l app.kubernetes.io/name=gha-runner-scale-set-controller --tail=50
-
-# Check secret exists
-kubectl get secret controller-manager -n actions-runner-system
-```
-
-### Fleet Bundle Fails with CRD Not Found
-
-**Symptom**: Fleet reports validation errors for `AutoscalingRunnerSet`
-
-**Solution**: Install official ARC controller first:
-```bash
-./scripts/install-github-arc.sh nprd-apps
-```
-
-**Note**: CRDs are installed immediately when Helm installs the chart, even if the controller pod takes time to start. Fleet only needs CRDs to validate resources.
-
-### CRD Version Mismatch
-
-**Symptom**: Fleet resources use legacy CRDs (`RunnerDeployment`) but official controller is installed (`AutoscalingRunnerSet`)
-
-**Solution**:
-1. Check which CRDs exist: `kubectl get crd | grep -E "autoscalingrunnerset|runnerdeployment"`
-2. Update Fleet resources to use `AutoscalingRunnerSet` (official version)
-3. Or migrate from legacy: See migration section in official docs
-
-### Pods Stuck in ContainerCreating
-
-**Symptom**: Pods show `0/2 ContainerCreating` with "secret controller-manager not found"
-
-**Solution**: Create the secret (even if empty):
-```bash
-kubectl create secret generic controller-manager -n actions-runner-system \
-  --from-literal=github_token=""
-```
-
-### Checking Secrets
-
-#### Controller Secret
-
-```bash
-# View controller secret (note: values are base64 encoded)
-kubectl get secret controller-manager -n actions-runner-system -o yaml
-
-# Decode values
-kubectl get secret controller-manager -n actions-runner-system -o jsonpath='{.data.github_token}' | base64 -d
-kubectl get secret controller-manager -n actions-runner-system -o jsonpath='{.data.github_app_id}' | base64 -d
-```
-
-#### Runner Scale Set Secret
-
-```bash
-# View runner secret (replace 'managed-cicd' with your namespace)
-kubectl get secret github-app-secret -n managed-cicd -o yaml
-
-# Decode values
-kubectl get secret github-app-secret -n managed-cicd -o jsonpath='{.data.github_app_id}' | base64 -d
-kubectl get secret github-app-secret -n managed-cicd -o jsonpath='{.data.github_app_installation_id}' | base64 -d
-```
-
-## Verification
-
-### Verification Checklist
-
-- [ ] ARC controller installed and running
-- [ ] CRDs verified: `kubectl get crd | grep runner`
-- [ ] Controller secret created: `kubectl get secret controller-manager -n actions-runner-system`
-- [ ] Runner scale set secret created (in runner namespace)
-- [ ] Fleet GitRepo configured
-- [ ] Fleet paths point to runner resources only (not controller)
-- [ ] Fleet bundle status is Active (not stuck in validation)
-- [ ] Runner resources applied successfully
-- [ ] Runner pods created: `kubectl get pods -n <runner-namespace>`
-
-### Check Controller Status
-
-```bash
-# Check pod status
-kubectl get pods -n actions-runner-system
-
-# Check controller logs (official version)
-kubectl logs -n actions-runner-system -l app.kubernetes.io/name=gha-runner-scale-set-controller --tail=50
-```
-
-Expected: Pods should show `Running` status and logs should show no authentication errors.
-
-### Check Fleet Status
-
-```bash
-# Check Fleet bundles
-kubectl get bundle -A | grep runner
-
-# Check Fleet bundle status
-kubectl describe bundle <fleet-bundle-name> -n fleet-default
-
-# Check Fleet GitRepo
-kubectl get gitrepo -A
-```
-
-## Important Notes
-
-### Fleet Validation (Already Working)
-
-✅ **Fleet can validate `AutoscalingRunnerSet` resources right now (official version)**  
-✅ **CRDs are installed on both clusters**  
-✅ **Controller doesn't need to be running for Fleet validation**  
-✅ **Using official GitHub-supported ARC** (`actions.github.com/v1alpha1`)
-
-The controller only needs to be running when:
-- Actually managing and scaling runners
-- Processing runner lifecycle events
-- Communicating with GitHub API
-
-### Secret Volume Mount
-
-The deployment expects a secret named `controller-manager` in the `actions-runner-system` namespace. If the secret doesn't exist, pods will fail to start due to volume mount errors.
-
-Even with an empty secret, the CRDs are installed and Fleet can validate resources. However, the controller will crash until proper GitHub credentials are provided.
-
-## Related Documentation
-
-- [Official GitHub ARC Documentation](https://docs.github.com/en/actions/tutorials/use-actions-runner-controller)
-- [Quickstart Guide](https://docs.github.com/en/actions/tutorials/use-actions-runner-controller/quickstart)
-- [Deploy Runner Scale Sets](https://docs.github.com/en/actions/tutorials/use-actions-runner-controller/deploy-runner-scale-sets)
-- [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller)
-
-## Summary
-
-✅ **Install controller first** - Official ARC controller (with CRDs) must be installed before Fleet processes runner resources  
-✅ **Separate controller from runners** - Controller via Helm/Terraform, runners via Fleet  
-✅ **Use official version** - Official GitHub-supported ARC (`AutoscalingRunnerSet`, not legacy `RunnerDeployment`)  
-✅ **Verify CRD compatibility** - Ensure Fleet resources use `AutoscalingRunnerSet` (actions.github.com/v1alpha1)  
-✅ **Fleet paths** - Only include runner resources, not controller manifests  
-✅ **Use GitHub App** - Recommended for production environments
-
-This ensures Fleet can validate runner resources because CRDs exist when Fleet processes them, and the controller can manage runners once secrets are configured.
+To bring ARC back, install the current `gha-runner-scale-set-controller` chart together with a
+`gha-runner-scale-set` per runner group (GitHub supports only the latest ARC release). The old
+setup guide and scripts are in the git history before this change.
diff --git a/scripts/README.md b/scripts/README.md
index 309bf06..c82f0b1 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -21,25 +21,11 @@ Rancher-specific configuration and management:
 - **`install-system-agent.sh`** - Install Rancher system-agent on downstream cluster nodes
 - **`check-agent-status.sh`** - Check cattle-cluster-agent status and troubleshoot DNS issues
 
-### GitHub ARC (Actions Runner Controller) Scripts
-
-GitHub Actions Runner Controller installation and configuration:
-
-- **`install-github-arc.sh`** - Install official GitHub ARC controller and CRDs
-- **`setup-github-app-arc.sh`** - Interactive script for GitHub App creation and secret setup
-- **`complete-arc-setup.sh`** - Complete ARC setup with existing GitHub App
-- **`create-github-app-secrets.sh`** - Create Kubernetes secrets for GitHub App authentication
-- **`get-github-app-installation-id.sh`** - Get GitHub App Installation ID using JWT
-- **`list-github-apps.sh`** - List GitHub Apps for an organization
-- **`suggest-github-app-name.sh`** - Suggest unique GitHub App names to avoid conflicts
-- **`generate-jwt.sh`** - Generate JWT for GitHub App authentication
-
 ### Database Setup Scripts
 
 Database operator installation:
 
 - **`install-cloudnativepg.sh`** - Install CloudNativePG operator for PostgreSQL
-- **`install-mongodb-community-operator.sh`** - Install MongoDB Community Operator CRDs and operator for MongoDB management (required for Graylog Helm chart)
 
 ### Utility Scripts
 
@@ -82,29 +68,12 @@ rancher token delete all               # clear the cache / force re-login
   --nodes 192.168.14.110 192.168.14.111
 ```
 
-### GitHub ARC Setup
-
-```bash
-# Interactive setup (recommended)
-./scripts/setup-github-app-arc.sh
-
-# Install ARC controller
-./scripts/install-github-arc.sh nprd-apps
-
-# Complete setup with existing GitHub App
-./scripts/complete-arc-setup.sh
-```
-
 ### Database Setup
 
 ```bash
 # Install CloudNativePG
 export KUBECONFIG=~/.kube/nprd-apps.yaml
 ./scripts/install-cloudnativepg.sh nprd-apps
-
-# Install MongoDB Community Operator (for Graylog)
-export KUBECONFIG=~/.kube/nprd-apps.yaml
-./scripts/install-mongodb-community-operator.sh nprd-apps
 ```
 
 ## Script Dependencies
@@ -117,12 +86,9 @@ Most scripts require:
 - Access to Terraform variables (usually `terraform/terraform.tfvars`)
 
 Some scripts require:
-- `gh` CLI - GitHub CLI (for GitHub-related scripts)
-- `openssl` - SSL/TLS toolkit (for JWT generation)
 - SSH access to cluster nodes (for agent installation)
 
 ## Related Documentation
 
-- **[../docs/GITHUB_ARC_SETUP.md](../docs/GITHUB_ARC_SETUP.md)** - Complete GitHub ARC setup guide
 - **[../docs/RANCHER_API_TOKEN_CREATION.md](../docs/RANCHER_API_TOKEN_CREATION.md)** - Rancher API token documentation
 - **[../docs/CLUSTER_ACCESS_AND_SSO.md](../docs/CLUSTER_ACCESS_AND_SSO.md)** - kubectl / Rancher SSO access and break-glass
diff --git a/scripts/complete-arc-setup.sh b/scripts/complete-arc-setup.sh
deleted file mode 100755
index c411e50..0000000
--- a/scripts/complete-arc-setup.sh
+++ /dev/null
@@ -1,189 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Complete ARC setup with existing GitHub App
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-BLUE='\033[0;34m'
-GREEN='\033[0;32m'
-CYAN='\033[0;36m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-# These values should be provided as parameters or prompted
-APP_ID=""
-APP_NAME=""
-ORG_NAME=""
-
-log_info() {
-    echo -e "${BLUE}ℹ${NC} $1"
-}
-
-log_success() {
-    echo -e "${GREEN}✓${NC} $1"
-}
-
-prompt() {
-    echo -e "${CYAN}?${NC} $1"
-}
-
-echo "=================================================="
-echo "  Complete ARC Setup"
-echo "=================================================="
-echo ""
-
-log_info "Step 0: Collect GitHub App Information"
-echo ""
-prompt "Enter your GitHub App ID:"
-read -r APP_ID
-
-if [[ -z "$APP_ID" ]]; then
-    echo "App ID cannot be empty. Exiting."
-    exit 1
-fi
-
-prompt "Enter your GitHub App name (optional):"
-read -r APP_NAME
-APP_NAME="${APP_NAME:-GitHub App}"
-
-prompt "Enter your GitHub organization name:"
-read -r ORG_NAME
-
-if [[ -z "$ORG_NAME" ]]; then
-    echo "Organization name cannot be empty. Exiting."
-    exit 1
-fi
-
-echo ""
-log_success "GitHub App information collected!"
-echo ""
-echo "App Details:"
-echo "  • Name: ${APP_NAME}"
-echo "  • App ID: ${APP_ID}"
-echo "  • Organization: ${ORG_NAME}"
-echo ""
-
-echo "=================================================="
-echo "  Remaining Steps"
-echo "=================================================="
-echo ""
-
-log_info "Step 1: Generate Private Key (if not already done)"
-echo ""
-echo "1. Go to your app page:"
-echo -e "${CYAN}https://github.com/organizations/${ORG_NAME}/settings/apps/${APP_ID}${NC}"
-echo ""
-echo "2. Scroll down to 'Private keys' section"
-echo "3. Click 'Generate a private key'"
-echo "4. Download the .pem file (you can only download once!)"
-echo "5. Save it to a secure location (e.g., ~/.github-arc/private-key.pem)"
-echo ""
-prompt "Press Enter when you have downloaded the private key..."
-read -r
-
-log_info "Step 2: Install App and Get Installation ID"
-echo ""
-echo "1. On the app page, click 'Install App' (in sidebar or top)"
-echo "2. Select your organization: ${ORG_NAME}"
-echo "3. Choose 'All repositories' (recommended for ARC)"
-echo "4. Click 'Install'"
-echo "5. After installation, note the Installation ID from the URL:"
-echo "   URL will be: /installations/<INSTALLATION_ID>"
-echo ""
-echo "   Or check the page - Installation ID is shown on the installation page"
-echo ""
-prompt "Enter the Installation ID:"
-read -r INSTALLATION_ID
-
-if [[ -z "$INSTALLATION_ID" ]]; then
-    echo "Installation ID cannot be empty. Exiting."
-    exit 1
-fi
-
-log_info "Step 3: Private Key Path"
-echo ""
-prompt "Enter the full path to your private key file (.pem):"
-read -r PRIVATE_KEY_PATH
-
-if [[ ! -f "$PRIVATE_KEY_PATH" ]]; then
-    echo "Private key file not found: $PRIVATE_KEY_PATH"
-    exit 1
-fi
-
-log_info "Step 4: Select Clusters"
-echo ""
-prompt "Which cluster(s) should we set up? (1=nprd-apps, 2=prd-apps, 3=both):"
-read -r CLUSTER_CHOICE
-
-case "$CLUSTER_CHOICE" in
-    1)
-        CLUSTERS=("nprd-apps")
-        ;;
-    2)
-        CLUSTERS=("prd-apps")
-        ;;
-    3)
-        CLUSTERS=("nprd-apps" "prd-apps")
-        ;;
-    *)
-        echo "Invalid choice. Using both clusters."
-        CLUSTERS=("nprd-apps" "prd-apps")
-        ;;
-esac
-
-prompt "Enter namespace for runner secret (default: managed-cicd):"
-read -r RUNNER_NAMESPACE
-RUNNER_NAMESPACE="${RUNNER_NAMESPACE:-managed-cicd}"
-
-echo ""
-echo "=================================================="
-echo "  Creating Kubernetes Secrets"
-echo "=================================================="
-echo ""
-
-for CLUSTER in "${CLUSTERS[@]}"; do
-    echo ""
-    log_info "Setting up secrets for cluster: $CLUSTER"
-    echo ""
-    
-    "$SCRIPT_DIR/create-github-app-secrets.sh" \
-        -c "$CLUSTER" \
-        -i "$APP_ID" \
-        -n "$INSTALLATION_ID" \
-        -k "$PRIVATE_KEY_PATH" \
-        || {
-            log_warning "Failed to create secrets for $CLUSTER"
-            continue
-        }
-done
-
-echo ""
-echo "=================================================="
-echo "  Setup Complete!"
-echo "=================================================="
-echo ""
-
-log_success "GitHub App secrets have been created!"
-echo ""
-echo "Summary:"
-echo "  • App ID: ${APP_ID}"
-echo "  • Installation ID: ${INSTALLATION_ID}"
-echo "  • Clusters: ${CLUSTERS[*]}"
-echo "  • Runner Namespace: ${RUNNER_NAMESPACE}"
-echo ""
-echo "Next steps:"
-echo "  1. Verify your AutoscalingRunnerSet references the secret:"
-echo "     spec.githubConfigSecret: github-app-secret"
-echo ""
-echo "  2. Check controller pods:"
-for CLUSTER in "${CLUSTERS[@]}"; do
-    echo "     kubectl --kubeconfig ~/.kube/${CLUSTER}.yaml get pods -n actions-runner-system"
-done
-echo ""
-echo "  3. Check controller logs:"
-for CLUSTER in "${CLUSTERS[@]}"; do
-    echo "     kubectl --kubeconfig ~/.kube/${CLUSTER}.yaml logs -n actions-runner-system \\"
-    echo "       -l app.kubernetes.io/name=gha-runner-scale-set-controller --tail=50"
-done
-echo ""
diff --git a/scripts/create-github-app-secrets.sh b/scripts/create-github-app-secrets.sh
deleted file mode 100755
index 673db05..0000000
--- a/scripts/create-github-app-secrets.sh
+++ /dev/null
@@ -1,281 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Script to create GitHub App and set up Kubernetes secrets for ARC
-# Note: GitHub App creation must be done via web UI, this script helps with secret setup
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-# Configuration
-ORG_NAME="${GITHUB_ORG:-DataKnifeAI}"
-APP_NAME="${GITHUB_APP_NAME:-ARC Runner Controller}"
-NAMESPACE="${RUNNER_NAMESPACE:-managed-cicd}"
-SECRET_NAME="${SECRET_NAME:-github-app-secret}"
-CONTROLLER_SECRET_NAME="${CONTROLLER_SECRET_NAME:-controller-manager}"
-CONTROLLER_NAMESPACE="${CONTROLLER_NAMESPACE:-actions-runner-system}"
-
-usage() {
-    cat <<EOF
-Usage: $0 [OPTIONS]
-
-Create GitHub App secrets for GitHub Actions Runner Controller (ARC).
-
-OPTIONS:
-    -c, --cluster CLUSTER     Cluster name (nprd-apps or prd-apps) [required]
-    -i, --app-id ID           GitHub App ID [required]
-    -n, --installation-id ID  GitHub App Installation ID [required]
-    -k, --private-key PATH    Path to GitHub App private key (.pem file) [required]
-    -s, --skip-controller     Skip creating controller secret (only create runner secret)
-    -r, --skip-runner         Skip creating runner secret (only create controller secret)
-    -h, --help                Show this help message
-
-ENVIRONMENT VARIABLES:
-    GITHUB_ORG               GitHub organization name (default: DataKnifeAI)
-    GITHUB_APP_NAME          GitHub App name (default: ARC Runner Controller)
-    RUNNER_NAMESPACE         Kubernetes namespace for runner secret (default: managed-cicd)
-    SECRET_NAME              Name of the runner secret (default: github-app-secret)
-    CONTROLLER_SECRET_NAME   Name of the controller secret (default: controller-manager)
-    CONTROLLER_NAMESPACE     Namespace for controller secret (default: actions-runner-system)
-
-EXAMPLES:
-    # Create both secrets for nprd-apps cluster
-    $0 -c nprd-apps -i 123456 -n 789012 -k /path/to/private-key.pem
-
-    # Only create runner secret
-    $0 -c nprd-apps -i 123456 -n 789012 -k /path/to/private-key.pem --skip-controller
-
-    # Create secrets for both clusters
-    $0 -c nprd-apps -i 123456 -n 789012 -k /path/to/private-key.pem
-    $0 -c prd-apps -i 123456 -n 789012 -k /path/to/private-key.pem
-
-GITHUB APP CREATION (Manual Step):
-    1. Go to: https://github.com/organizations/${ORG_NAME}/settings/apps/new
-    2. Configure the app:
-       - Name: ${APP_NAME}
-       - Homepage URL: https://github.com/${ORG_NAME}
-       - Webhook: Unchecked
-       - Repository permissions:
-         * Actions: Read & Write
-         * Metadata: Read-only
-       - Organization permissions:
-         * Self-hosted runners: Read & Write
-       - Where can this GitHub App be installed?: Only on this account
-    3. Click "Create GitHub App"
-    4. Note the App ID (visible on the app page)
-    5. Generate and download the private key
-    6. Install the app on your organization
-    7. Note the Installation ID (from the installation URL)
-
-EOF
-}
-
-log_info() {
-    echo -e "${BLUE}ℹ${NC} $1"
-}
-
-log_success() {
-    echo -e "${GREEN}✓${NC} $1"
-}
-
-log_warning() {
-    echo -e "${YELLOW}⚠${NC} $1"
-}
-
-log_error() {
-    echo -e "${RED}✗${NC} $1" >&2
-}
-
-# Parse arguments
-CLUSTER=""
-APP_ID=""
-INSTALLATION_ID=""
-PRIVATE_KEY_PATH=""
-SKIP_CONTROLLER=false
-SKIP_RUNNER=false
-
-while [[ $# -gt 0 ]]; do
-    case $1 in
-        -c|--cluster)
-            CLUSTER="$2"
-            shift 2
-            ;;
-        -i|--app-id)
-            APP_ID="$2"
-            shift 2
-            ;;
-        -n|--installation-id)
-            INSTALLATION_ID="$2"
-            shift 2
-            ;;
-        -k|--private-key)
-            PRIVATE_KEY_PATH="$2"
-            shift 2
-            ;;
-        -s|--skip-controller)
-            SKIP_CONTROLLER=true
-            shift
-            ;;
-        -r|--skip-runner)
-            SKIP_RUNNER=true
-            shift
-            ;;
-        -h|--help)
-            usage
-            exit 0
-            ;;
-        *)
-            log_error "Unknown option: $1"
-            usage
-            exit 1
-            ;;
-    esac
-done
-
-# Validate required arguments
-if [[ -z "$CLUSTER" ]]; then
-    log_error "Cluster name is required (-c/--cluster)"
-    usage
-    exit 1
-fi
-
-if [[ "$CLUSTER" != "nprd-apps" && "$CLUSTER" != "prd-apps" ]]; then
-    log_error "Invalid cluster name: $CLUSTER (must be 'nprd-apps' or 'prd-apps')"
-    exit 1
-fi
-
-if [[ "$SKIP_RUNNER" == false ]]; then
-    if [[ -z "$APP_ID" || -z "$INSTALLATION_ID" || -z "$PRIVATE_KEY_PATH" ]]; then
-        log_error "Missing required arguments for runner secret: --app-id, --installation-id, --private-key"
-        usage
-        exit 1
-    fi
-fi
-
-if [[ "$SKIP_CONTROLLER" == false ]]; then
-    if [[ -z "$APP_ID" || -z "$INSTALLATION_ID" || -z "$PRIVATE_KEY_PATH" ]]; then
-        log_error "Missing required arguments for controller secret: --app-id, --installation-id, --private-key"
-        usage
-        exit 1
-    fi
-fi
-
-# Validate private key file
-if [[ -n "$PRIVATE_KEY_PATH" && ! -f "$PRIVATE_KEY_PATH" ]]; then
-    log_error "Private key file not found: $PRIVATE_KEY_PATH"
-    exit 1
-fi
-
-# Set kubeconfig based on cluster
-KUBECONFIG_FILE="$HOME/.kube/${CLUSTER}.yaml"
-if [[ ! -f "$KUBECONFIG_FILE" ]]; then
-    log_error "Kubeconfig file not found: $KUBECONFIG_FILE"
-    exit 1
-fi
-
-export KUBECONFIG="$KUBECONFIG_FILE"
-
-log_info "Using cluster: $CLUSTER"
-log_info "Using kubeconfig: $KUBECONFIG_FILE"
-
-# Read private key
-if [[ -n "$PRIVATE_KEY_PATH" ]]; then
-    PRIVATE_KEY=$(cat "$PRIVATE_KEY_PATH")
-    if [[ -z "$PRIVATE_KEY" ]]; then
-        log_error "Private key file is empty: $PRIVATE_KEY_PATH"
-        exit 1
-    fi
-fi
-
-# Create runner secret
-if [[ "$SKIP_RUNNER" == false ]]; then
-    log_info "Creating runner secret '$SECRET_NAME' in namespace '$NAMESPACE'..."
-    
-    # Check if namespace exists
-    if ! kubectl get namespace "$NAMESPACE" &>/dev/null; then
-        log_warning "Namespace '$NAMESPACE' does not exist. Creating it..."
-        kubectl create namespace "$NAMESPACE"
-        log_success "Namespace '$NAMESPACE' created"
-    fi
-    
-    # Create or update the secret
-    kubectl create secret generic "$SECRET_NAME" \
-        -n "$NAMESPACE" \
-        --from-literal=github_app_id="$APP_ID" \
-        --from-literal=github_app_installation_id="$INSTALLATION_ID" \
-        --from-literal=github_app_private_key="$PRIVATE_KEY" \
-        --dry-run=client -o yaml | kubectl apply -f -
-    
-    log_success "Runner secret '$SECRET_NAME' created/updated in namespace '$NAMESPACE'"
-    
-    # Verify secret
-    if kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" &>/dev/null; then
-        log_success "Secret verified: $(kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" -o jsonpath='{.metadata.name}')"
-        log_info "Secret contains keys: $(kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" -o jsonpath='{.data}' | jq -r 'keys | @tsv' 2>/dev/null || echo 'github_app_id, github_app_installation_id, github_app_private_key')"
-    else
-        log_error "Failed to verify secret creation"
-        exit 1
-    fi
-fi
-
-# Create controller secret
-if [[ "$SKIP_CONTROLLER" == false ]]; then
-    log_info "Creating controller secret '$CONTROLLER_SECRET_NAME' in namespace '$CONTROLLER_NAMESPACE'..."
-    
-    # Check if namespace exists
-    if ! kubectl get namespace "$CONTROLLER_NAMESPACE" &>/dev/null; then
-        log_warning "Namespace '$CONTROLLER_NAMESPACE' does not exist. Creating it..."
-        kubectl create namespace "$CONTROLLER_NAMESPACE"
-        log_success "Namespace '$CONTROLLER_NAMESPACE' created"
-    fi
-    
-    # Create or update the secret
-    kubectl create secret generic "$CONTROLLER_SECRET_NAME" \
-        -n "$CONTROLLER_NAMESPACE" \
-        --from-literal=github_app_id="$APP_ID" \
-        --from-literal=github_app_installation_id="$INSTALLATION_ID" \
-        --from-literal=github_app_private_key="$PRIVATE_KEY" \
-        --dry-run=client -o yaml | kubectl apply -f -
-    
-    log_success "Controller secret '$CONTROLLER_SECRET_NAME' created/updated in namespace '$CONTROLLER_NAMESPACE'"
-    
-    # Verify secret
-    if kubectl get secret "$CONTROLLER_SECRET_NAME" -n "$CONTROLLER_NAMESPACE" &>/dev/null; then
-        log_success "Controller secret verified"
-        log_info "Restarting controller deployment to pick up new secret..."
-        if kubectl rollout restart deployment/gha-runner-scale-set-controller -n "$CONTROLLER_NAMESPACE" &>/dev/null; then
-            log_success "Controller deployment restarted"
-        else
-            log_warning "Could not restart controller deployment (may not exist yet)"
-        fi
-    else
-        log_error "Failed to verify controller secret creation"
-        exit 1
-    fi
-fi
-
-# Summary
-echo ""
-log_success "GitHub App secrets created successfully for cluster: $CLUSTER"
-echo ""
-echo "Next steps:"
-if [[ "$SKIP_RUNNER" == false ]]; then
-    echo "  1. Verify the AutoscalingRunnerSet references the secret:"
-    echo "     spec.githubConfigSecret: $SECRET_NAME"
-    echo ""
-fi
-if [[ "$SKIP_CONTROLLER" == false ]]; then
-    echo "  2. Check controller pod status:"
-    echo "     kubectl --kubeconfig $KUBECONFIG_FILE get pods -n $CONTROLLER_NAMESPACE"
-    echo ""
-fi
-echo "  3. Check controller logs for any errors:"
-echo "     kubectl --kubeconfig $KUBECONFIG_FILE logs -n $CONTROLLER_NAMESPACE -l app.kubernetes.io/name=gha-runner-scale-set-controller --tail=50"
-echo ""
diff --git a/scripts/generate-jwt.sh b/scripts/generate-jwt.sh
deleted file mode 100755
index 27297b0..0000000
--- a/scripts/generate-jwt.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Generate JWT for GitHub App using bash/openssl
-# Based on: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
-
-# Parameters - no defaults to prevent hardcoded secrets
-CLIENT_ID="${1:-}"
-PRIVATE_KEY_PATH="${2:-}"
-
-if [[ -z "$CLIENT_ID" ]]; then
-    echo "Error: Client ID is required" >&2
-    echo "Usage: $0 <client_id> <private_key_path>" >&2
-    exit 1
-fi
-
-if [[ -z "$PRIVATE_KEY_PATH" ]]; then
-    echo "Error: Private key path is required" >&2
-    echo "Usage: $0 <client_id> <private_key_path>" >&2
-    exit 1
-fi
-
-if [[ ! -f "$PRIVATE_KEY_PATH" ]]; then
-    echo "Error: Private key file not found: $PRIVATE_KEY_PATH" >&2
-    exit 1
-fi
-
-# Base64 URL encoding function
-b64enc() { openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n'; }
-
-# Current time
-now=$(date +%s)
-iat=$((${now} - 60))  # Issued 60 seconds in the past
-exp=$((${now} + 600))  # Expires 10 minutes in the future
-
-# Header
-header_json='{
-    "typ":"JWT",
-    "alg":"RS256"
-}'
-header=$(echo -n "${header_json}" | b64enc)
-
-# Payload
-payload_json="{
-    \"iat\":${iat},
-    \"exp\":${exp},
-    \"iss\":\"${CLIENT_ID}\"
-}"
-payload=$(echo -n "${payload_json}" | b64enc)
-
-# Signature
-header_payload="${header}.${payload}"
-signature=$(echo -n "${header_payload}" | openssl dgst -sha256 -sign "${PRIVATE_KEY_PATH}" | b64enc)
-
-# Create JWT
-JWT="${header_payload}.${signature}"
-echo "$JWT"
diff --git a/scripts/get-github-app-installation-id.sh b/scripts/get-github-app-installation-id.sh
deleted file mode 100755
index 6d5e33d..0000000
--- a/scripts/get-github-app-installation-id.sh
+++ /dev/null
@@ -1,179 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Get GitHub App Installation ID using JWT authentication
-# Based on: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
-
-# Parameters with no defaults - user must provide
-APP_ID="${1:-}"
-CLIENT_ID="${2:-}"
-PRIVATE_KEY_PATH="${3:-}"
-ORG_NAME="${4:-}"
-
-BLUE='\033[0;34m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-log_info() {
-    echo -e "${BLUE}ℹ${NC} $1"
-}
-
-log_success() {
-    echo -e "${GREEN}✓${NC} $1"
-}
-
-log_warning() {
-    echo -e "${YELLOW}⚠${NC} $1"
-}
-
-log_error() {
-    echo -e "${RED}✗${NC} $1" >&2
-}
-
-# Validate required parameters
-if [[ -z "$APP_ID" ]]; then
-    log_error "App ID is required"
-    echo "Usage: $0 <app_id> [client_id] [private_key_path] [org_name]" >&2
-    exit 1
-fi
-
-if [[ -z "$CLIENT_ID" ]]; then
-    log_error "Client ID is required"
-    echo "Usage: $0 <app_id> <client_id> [private_key_path] [org_name]" >&2
-    exit 1
-fi
-
-if [[ -z "$PRIVATE_KEY_PATH" ]]; then
-    log_error "Private key path is required"
-    echo "Usage: $0 <app_id> <client_id> <private_key_path> [org_name]" >&2
-    exit 1
-fi
-
-if [[ -z "$ORG_NAME" ]]; then
-    log_error "Organization name is required"
-    echo "Usage: $0 <app_id> <client_id> <private_key_path> <org_name>" >&2
-    exit 1
-fi
-
-# Check if private key exists
-if [[ ! -f "$PRIVATE_KEY_PATH" ]]; then
-    log_error "Private key file not found: $PRIVATE_KEY_PATH"
-    exit 1
-fi
-
-log_info "Generating JWT token for GitHub App..."
-log_info "App ID: $APP_ID"
-log_info "Client ID: $CLIENT_ID"
-log_info "Private Key: $PRIVATE_KEY_PATH"
-
-# Generate JWT using bash/openssl (no dependencies needed)
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-GENERATE_JWT_SCRIPT="${SCRIPT_DIR}/generate-jwt.sh"
-
-if [[ ! -f "$GENERATE_JWT_SCRIPT" ]]; then
-    log_error "JWT generator script not found: $GENERATE_JWT_SCRIPT"
-    exit 1
-fi
-
-JWT=$("$GENERATE_JWT_SCRIPT" "$CLIENT_ID" "$PRIVATE_KEY_PATH" 2>/dev/null)
-
-if [[ -z "$JWT" ]]; then
-    log_error "Failed to generate JWT token"
-    exit 1
-fi
-
-log_success "JWT token generated"
-
-# Use JWT to get app information
-log_info "Getting app information..."
-APP_INFO=$(gh api "app" \
-    --header "Accept: application/vnd.github+json" \
-    --header "Authorization: Bearer ${JWT}" \
-    --header "X-GitHub-Api-Version: 2022-11-28" 2>/dev/null || echo "")
-
-if [[ -z "$APP_INFO" ]]; then
-    log_error "Failed to authenticate with GitHub App"
-    log_info "Make sure the app exists and the private key is correct"
-    exit 1
-fi
-
-log_success "Authenticated with GitHub App"
-
-# Get installations for the app (using app/installations endpoint)
-log_info "Getting installations for this app..."
-INSTALLATIONS=$(gh api "app/installations" \
-    --header "Accept: application/vnd.github+json" \
-    --header "Authorization: Bearer ${JWT}" \
-    --header "X-GitHub-Api-Version: 2022-11-28" 2>/dev/null || echo "[]")
-
-if [[ "$INSTALLATIONS" == "[]" || -z "$INSTALLATIONS" ]]; then
-    log_warning "No installations found for this app"
-    echo ""
-    log_info "The app may not be installed yet. To install it:"
-    echo "  1. Go to: https://github.com/organizations/${ORG_NAME}/settings/apps/${APP_ID}"
-    echo "  2. Click 'Install App'"
-    echo "  3. Select your organization: ${ORG_NAME}"
-    echo "  4. Choose 'All repositories' (recommended)"
-    echo "  5. Click 'Install'"
-    echo ""
-    log_info "After installation, run this script again to get the Installation ID"
-    exit 0
-fi
-
-# Parse installation ID - check for app_id match or get the first one
-INSTALLATION_ID=$(echo "$INSTALLATIONS" | jq -r ".[] | select(.app_id == ${APP_ID}) | .id" 2>/dev/null || echo "")
-
-# If no match found by app_id, try to get the first installation
-if [[ -z "$INSTALLATION_ID" || "$INSTALLATION_ID" == "null" ]]; then
-    INSTALLATION_ID=$(echo "$INSTALLATIONS" | jq -r ".[0].id" 2>/dev/null || echo "")
-fi
-
-if [[ -z "$INSTALLATION_ID" || "$INSTALLATION_ID" == "null" ]]; then
-    log_warning "Could not find installation for App ID ${APP_ID}"
-    echo ""
-    log_info "Available installations:"
-    echo "$INSTALLATIONS" | jq -r '.[] | "  - Installation ID: \(.id), App ID: \(.app_id), App Slug: \(.app_slug)"' 2>/dev/null || echo "  (unable to parse)"
-    echo ""
-    log_info "Check installations manually:"
-    echo "  https://github.com/organizations/${ORG_NAME}/settings/installations"
-    exit 1
-fi
-
-# Get installation details
-INSTALLATION_INFO=$(gh api "app/installations/${INSTALLATION_ID}" \
-    --header "Accept: application/vnd.github+json" \
-    --header "Authorization: Bearer ${JWT}" \
-    --header "X-GitHub-Api-Version: 2022-11-28" 2>/dev/null || echo "")
-
-if [[ -n "$INSTALLATION_INFO" ]]; then
-    echo ""
-    log_success "Found Installation!"
-    echo ""
-    echo "Installation Details:"
-    echo "$INSTALLATION_INFO" | jq -r '
-        "  Installation ID: \(.id)",
-        "  Account: \(.account.login)",
-        "  Repository Selection: \(.repository_selection)",
-        "  Permissions:",
-        (.permissions | to_entries | .[] | "    \(.key): \(.value)")
-    ' 2>/dev/null || echo "  Installation ID: ${INSTALLATION_ID}"
-else
-    echo ""
-    log_success "Installation ID: ${INSTALLATION_ID}"
-fi
-
-echo ""
-echo "=================================================="
-echo "  Installation ID: ${INSTALLATION_ID}"
-echo "=================================================="
-echo ""
-echo "You can now create Kubernetes secrets using:"
-echo ""
-echo "  ./scripts/create-github-app-secrets.sh \\"
-echo "    -c nprd-apps \\"
-echo "    -i ${APP_ID} \\"
-echo "    -n ${INSTALLATION_ID} \\"
-echo "    -k ${PRIVATE_KEY_PATH}"
-echo ""
diff --git a/scripts/install-github-arc.sh b/scripts/install-github-arc.sh
deleted file mode 100755
index 4af5267..0000000
--- a/scripts/install-github-arc.sh
+++ /dev/null
@@ -1,174 +0,0 @@
-#!/bin/bash
-
-# GitHub Actions Runner Controller (ARC) Installation Script
-# Installs official GitHub-supported ARC controller and CRDs
-# Uses AutoscalingRunnerSet (official version, not legacy RunnerDeployment)
-# Official documentation: https://docs.github.com/en/actions/tutorials/use-actions-runner-controller
-
-set -e
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-# Configuration - Official GitHub ARC (AutoscalingRunnerSet)
-NAMESPACE="${ARC_NAMESPACE:-actions-runner-system}"
-RELEASE_NAME="${ARC_RELEASE_NAME:-gha-runner-scale-set-controller}"
-CHART="oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller"
-# Official chart - no repo needed, uses OCI registry
-
-# Cluster selection
-CLUSTER="${1:-nprd-apps}"
-
-echo -e "${GREEN}========================================${NC}"
-echo -e "${GREEN}GitHub Actions Runner Controller (ARC) Installation${NC}"
-echo -e "${GREEN}Official GitHub-Supported Version${NC}"
-echo -e "${GREEN}========================================${NC}"
-echo ""
-echo "This installs the official GitHub-supported ARC controller."
-echo "CRDs: AutoscalingRunnerSet, EphemeralRunnerSet, EphemeralRunner"
-echo "Runner resources should be managed via Fleet after CRDs are installed."
-echo ""
-echo "Documentation: https://docs.github.com/en/actions/tutorials/use-actions-runner-controller"
-echo ""
-
-# Check if we're in the right directory
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-cd "$REPO_ROOT"
-
-# Check prerequisites
-echo -e "${YELLOW}Checking prerequisites...${NC}"
-
-if ! command -v kubectl &> /dev/null; then
-    echo -e "${RED}Error: kubectl not found${NC}"
-    exit 1
-fi
-echo "✓ kubectl found"
-
-if ! command -v helm &> /dev/null; then
-    echo -e "${RED}Error: helm not found${NC}"
-    exit 1
-fi
-echo "✓ helm found"
-
-# Official chart uses OCI registry, no Helm repo needed
-echo -e "${YELLOW}Using official GitHub OCI chart...${NC}"
-echo "Chart: $CHART"
-echo "✓ Using OCI registry (no Helm repo needed)"
-
-# Set kubeconfig based on cluster
-KUBECONFIG_FILE="$HOME/.kube/${CLUSTER}.yaml"
-if [ -f "$KUBECONFIG_FILE" ]; then
-    export KUBECONFIG="$KUBECONFIG_FILE"
-    echo "✓ Using kubeconfig: $KUBECONFIG_FILE"
-else
-    echo -e "${YELLOW}⚠ Kubeconfig not found: $KUBECONFIG_FILE${NC}"
-    echo "Using default kubeconfig"
-fi
-
-# Verify cluster access
-echo -e "${YELLOW}Verifying cluster access...${NC}"
-if ! kubectl cluster-info &> /dev/null; then
-    echo -e "${RED}Error: Cannot access Kubernetes cluster${NC}"
-    exit 1
-fi
-echo "✓ Cluster access verified"
-echo ""
-
-# Check if already installed
-if helm list -n "$NAMESPACE" 2>/dev/null | grep -q "^${RELEASE_NAME}\s"; then
-    echo -e "${YELLOW}ARC controller already installed${NC}"
-    read -p "Do you want to upgrade/reinstall? (y/n) " -n 1 -r
-    echo
-    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-        echo "Installation cancelled"
-        exit 0
-    fi
-    UPGRADE_MODE="upgrade"
-else
-    UPGRADE_MODE="install"
-fi
-
-# Install ARC controller (includes CRDs)
-echo -e "${YELLOW}Installing official ARC controller and CRDs...${NC}"
-echo "Chart: $CHART"
-echo "Namespace: $NAMESPACE"
-echo "Version: Official GitHub-supported version"
-echo ""
-
-if [ "$UPGRADE_MODE" = "upgrade" ]; then
-    helm upgrade "$RELEASE_NAME" "$CHART" \
-        --namespace "$NAMESPACE" \
-        --create-namespace \
-        --wait \
-        --timeout 10m
-else
-    helm install "$RELEASE_NAME" "$CHART" \
-        --namespace "$NAMESPACE" \
-        --create-namespace \
-        --wait \
-        --timeout 10m
-fi
-
-echo ""
-echo -e "${GREEN}✓ ARC controller installed${NC}"
-echo ""
-
-# Wait for pods to be ready
-echo -e "${YELLOW}Waiting for controller pods to be ready...${NC}"
-kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=gha-runner-scale-set-controller -n "$NAMESPACE" --timeout=5m || {
-    echo -e "${YELLOW}⚠ Some pods may still be starting${NC}"
-}
-
-# Verify installation
-echo ""
-echo -e "${YELLOW}Verifying installation...${NC}"
-echo ""
-
-echo "ARC Controller Pods:"
-kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=gha-runner-scale-set-controller || echo "Pods may still be starting..."
-
-echo ""
-echo "ARC CRDs (Official Version):"
-kubectl get crd | grep -E "autoscalingrunnersets|ephemeralrunnersets|ephemeralrunners" || echo "CRDs may still be installing..."
-
-echo ""
-echo "Helm Release:"
-helm list -n "$NAMESPACE"
-
-echo ""
-echo -e "${GREEN}========================================${NC}"
-echo -e "${GREEN}Installation Complete!${NC}"
-echo -e "${GREEN}========================================${NC}"
-echo ""
-echo "Next steps:"
-echo "1. Verify CRDs are installed:"
-echo "   kubectl get crd | grep -E 'autoscalingrunnerset|ephemeralrunner'"
-echo ""
-echo "2. Configure runner resources via Fleet using AutoscalingRunnerSet:"
-echo "   - Ensure Fleet GitRepo is configured"
-echo "   - Fleet will now be able to validate AutoscalingRunnerSet resources"
-echo ""
-echo "3. Example Fleet resource (AutoscalingRunnerSet):"
-echo "   apiVersion: actions.github.com/v1beta1"
-echo "   kind: AutoscalingRunnerSet"
-echo "   metadata:"
-echo "     name: example-runner-scale-set"
-echo "   spec:"
-echo "     githubConfigUrl: https://github.com/your-org/your-repo"
-echo "     githubConfigSecret: github-config-secret"
-echo "     minRunners: 0"
-echo "     maxRunners: 5"
-echo ""
-echo "4. Official Documentation:"
-echo "   https://docs.github.com/en/actions/tutorials/use-actions-runner-controller"
-echo ""
-echo "Useful commands:"
-echo "  kubectl get pods -n $NAMESPACE"
-echo "  kubectl get crd | grep -E 'autoscalingrunnerset|ephemeralrunner'"
-echo "  kubectl get autoscalingrunnersets -A"
-echo "  helm list -n $NAMESPACE"
-echo ""
diff --git a/scripts/install-mongodb-community-operator.sh b/scripts/install-mongodb-community-operator.sh
deleted file mode 100755
index 9c86929..0000000
--- a/scripts/install-mongodb-community-operator.sh
+++ /dev/null
@@ -1,221 +0,0 @@
-#!/bin/bash
-
-# MongoDB Community Operator Installation Script
-# Installs MongoDB Community Operator CRDs and operator for MongoDB management
-# Required for Graylog Helm chart deployments
-
-set -e
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-# Configuration
-MONGODB_OPERATOR_NAMESPACE="${MONGODB_OPERATOR_NAMESPACE:-mongodb}"
-MONGODB_OPERATOR_RELEASE_NAME="${MONGODB_OPERATOR_RELEASE_NAME:-community-operator}"
-MONGODB_OPERATOR_CHART="mongodb/community-operator"
-MONGODB_HELM_REPO="https://mongodb.github.io/helm-charts"
-# MongoDB Community Operator CRD URL
-MONGODB_CRD_URL="https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/crd/bases/mongodbcommunity.mongodb.com_mongodbcommunity.yaml"
-
-# Cluster selection
-CLUSTER="${1:-nprd-apps}"
-
-echo -e "${GREEN}========================================${NC}"
-echo -e "${GREEN}MongoDB Community Operator Installation${NC}"
-echo -e "${GREEN}========================================${NC}"
-echo ""
-
-# Check if we're in the right directory
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-cd "$REPO_ROOT"
-
-# Check prerequisites
-echo -e "${YELLOW}Checking prerequisites...${NC}"
-
-if ! command -v kubectl &> /dev/null; then
-    echo -e "${RED}Error: kubectl not found${NC}"
-    exit 1
-fi
-echo "✓ kubectl found"
-
-if ! command -v helm &> /dev/null; then
-    echo -e "${RED}Error: helm not found${NC}"
-    exit 1
-fi
-echo "✓ helm found"
-
-# Set kubeconfig based on cluster
-KUBECONFIG_FILE="$HOME/.kube/${CLUSTER}.yaml"
-if [ -f "$KUBECONFIG_FILE" ]; then
-    export KUBECONFIG="$KUBECONFIG_FILE"
-    echo "✓ Using kubeconfig: $KUBECONFIG_FILE"
-else
-    echo -e "${YELLOW}⚠ Kubeconfig not found: $KUBECONFIG_FILE${NC}"
-    echo "Using default kubeconfig"
-fi
-
-# Verify cluster access
-echo -e "${YELLOW}Verifying cluster access...${NC}"
-if ! kubectl cluster-info &> /dev/null; then
-    echo -e "${RED}Error: Cannot access Kubernetes cluster${NC}"
-    exit 1
-fi
-echo "✓ Cluster access verified"
-echo ""
-
-# Check if already installed
-if helm list -n "$MONGODB_OPERATOR_NAMESPACE" 2>/dev/null | grep -q "^${MONGODB_OPERATOR_RELEASE_NAME}\s"; then
-    echo -e "${YELLOW}MongoDB Community Operator already installed${NC}"
-    read -p "Do you want to reinstall? (y/n) " -n 1 -r
-    echo
-    if [[ $REPLY =~ ^[Yy]$ ]]; then
-        echo "Removing existing installation..."
-        helm uninstall "$MONGODB_OPERATOR_RELEASE_NAME" -n "$MONGODB_OPERATOR_NAMESPACE" 2>/dev/null || true
-        kubectl delete namespace "$MONGODB_OPERATOR_NAMESPACE" --timeout=2m 2>/dev/null || true
-        echo "Waiting for cleanup..."
-        sleep 5
-    else
-        echo "Installation cancelled"
-        exit 0
-    fi
-fi
-
-# Add MongoDB Helm repository
-echo -e "${YELLOW}Adding MongoDB Helm repository...${NC}"
-helm repo add mongodb "$MONGODB_HELM_REPO" 2>/dev/null || echo "Repository already added"
-helm repo update
-echo "✓ Helm repository added and updated"
-echo ""
-
-# Install MongoDB Community Operator CRDs first
-# Note: The Helm chart may also include CRDs, but installing them separately
-# ensures they're available and matches the pattern used by other operators
-echo -e "${YELLOW}Installing MongoDB Community Operator CRDs...${NC}"
-echo "CRD URL: $MONGODB_CRD_URL"
-echo ""
-
-# Apply CRDs with server-side apply if supported, otherwise regular apply
-if kubectl apply --server-side -f "$MONGODB_CRD_URL" 2>/dev/null; then
-    echo "✓ CRDs applied using server-side apply"
-else
-    echo "⚠ Server-side apply not supported, using regular apply"
-    kubectl apply -f "$MONGODB_CRD_URL"
-    echo "✓ CRDs applied"
-fi
-
-echo ""
-
-# Install MongoDB Community Operator via Helm
-echo -e "${YELLOW}Installing MongoDB Community Operator...${NC}"
-echo "Chart: $MONGODB_OPERATOR_CHART"
-echo "Namespace: $MONGODB_OPERATOR_NAMESPACE"
-echo ""
-
-helm install "$MONGODB_OPERATOR_RELEASE_NAME" "$MONGODB_OPERATOR_CHART" \
-    --namespace "$MONGODB_OPERATOR_NAMESPACE" \
-    --create-namespace \
-    --set operator.watchNamespace='*' \
-    --wait \
-    --timeout 10m
-
-echo ""
-echo -e "${GREEN}✓ MongoDB Community Operator installed${NC}"
-echo ""
-
-# Wait for operator to be ready
-echo -e "${YELLOW}Waiting for operator pods to be ready...${NC}"
-# Wait for any pods in the namespace (Helm charts may use different labels)
-sleep 5
-kubectl wait --for=condition=ready pod --all -n "$MONGODB_OPERATOR_NAMESPACE" --timeout=5m 2>/dev/null || {
-    echo -e "${YELLOW}⚠ Some pods may still be starting${NC}"
-}
-
-# Verify installation
-echo ""
-echo -e "${YELLOW}Verifying installation...${NC}"
-echo ""
-
-# Find the deployment name dynamically
-DEPLOYMENT_NAME=$(kubectl get deployment -n "$MONGODB_OPERATOR_NAMESPACE" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-
-if [ -n "$DEPLOYMENT_NAME" ]; then
-    echo "Rolling out deployment: $DEPLOYMENT_NAME..."
-    kubectl rollout status "deployment/$DEPLOYMENT_NAME" -n "$MONGODB_OPERATOR_NAMESPACE" --timeout=5m || true
-else
-    echo "⚠ No deployment found, checking pods directly..."
-fi
-
-echo ""
-echo "MongoDB Community Operator Pods:"
-kubectl get pods -n "$MONGODB_OPERATOR_NAMESPACE"
-
-echo ""
-echo "MongoDB Community Operator CRDs:"
-kubectl get crd | grep mongodbcommunity || echo "CRDs may still be installing..."
-
-echo ""
-echo "MongoDB Community Operator Deployments:"
-kubectl get deployment -n "$MONGODB_OPERATOR_NAMESPACE"
-
-# Check operator status
-echo ""
-echo -e "${YELLOW}Operator Status:${NC}"
-if [ -n "$DEPLOYMENT_NAME" ] && kubectl get "deployment/$DEPLOYMENT_NAME" -n "$MONGODB_OPERATOR_NAMESPACE" &>/dev/null; then
-    READY=$(kubectl get "deployment/$DEPLOYMENT_NAME" -n "$MONGODB_OPERATOR_NAMESPACE" -o jsonpath='{.status.readyReplicas}' 2>/dev/null || echo "0")
-    DESIRED=$(kubectl get "deployment/$DEPLOYMENT_NAME" -n "$MONGODB_OPERATOR_NAMESPACE" -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "0")
-    if [ "$READY" = "$DESIRED" ] && [ "$READY" != "0" ]; then
-        echo -e "${GREEN}✓ Operator is ready (${READY}/${DESIRED} replicas)${NC}"
-    else
-        echo -e "${YELLOW}⚠ Operator is starting (${READY}/${DESIRED} replicas ready)${NC}"
-    fi
-else
-    echo -e "${YELLOW}⚠ Operator deployment status unavailable (may still be installing)${NC}"
-fi
-
-echo ""
-echo -e "${GREEN}========================================${NC}"
-echo -e "${GREEN}Installation Complete!${NC}"
-echo -e "${GREEN}========================================${NC}"
-echo ""
-echo "Next steps:"
-echo "1. Create a MongoDB instance using MongoDBCommunity CR:"
-echo ""
-echo "   apiVersion: mongodbcommunity.mongodb.com/v1"
-echo "   kind: MongoDBCommunity"
-echo "   metadata:"
-echo "     name: graylog-mongodb"
-echo "     namespace: graylog"
-echo "   spec:"
-echo "     members: 3"
-echo "     type: ReplicaSet"
-echo "     version: \"7.0.5\""
-echo "     security:"
-echo "       authentication:"
-echo "         modes: [\"SCRAM\"]"
-echo "     users:"
-echo "       - name: graylog"
-echo "         db: admin"
-echo "         passwordSecretRef:"
-echo "           name: graylog-mongodb-password"
-echo "         roles:"
-echo "           - name: readWrite"
-echo "             db: graylog"
-echo ""
-echo "2. Apply the MongoDB instance:"
-echo "   kubectl apply -f mongodb-instance.yaml"
-echo ""
-echo "3. Install Graylog Helm chart:"
-echo "   helm repo add graylog https://helm.graylog.org"
-echo "   helm repo update"
-echo "   helm install graylog graylog/graylog --namespace graylog --create-namespace"
-echo ""
-echo "Useful commands:"
-echo "  kubectl get pods -n $MONGODB_OPERATOR_NAMESPACE"
-echo "  kubectl get deployment -n $MONGODB_OPERATOR_NAMESPACE"
-echo "  kubectl get mongodbcommunity -A"
-echo "  kubectl api-resources | grep mongodbcommunity"
-echo ""
diff --git a/scripts/list-github-apps.sh b/scripts/list-github-apps.sh
deleted file mode 100755
index 7915b49..0000000
--- a/scripts/list-github-apps.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# List GitHub Apps for an organization using gh CLI
-
-ORG_NAME="${1:-${GITHUB_ORG:-DataKnifeAI}}"
-
-BLUE='\033[0;34m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-log_info() {
-    echo -e "${BLUE}ℹ${NC} $1"
-}
-
-echo "=================================================="
-echo "  GitHub Apps for Organization: ${ORG_NAME}"
-echo "=================================================="
-echo ""
-
-log_info "Note: GitHub Apps can only be listed via the web interface."
-echo ""
-echo "To view your GitHub Apps:"
-echo "  https://github.com/organizations/${ORG_NAME}/settings/apps"
-echo ""
-echo "Or for your personal account:"
-echo "  https://github.com/settings/apps"
-echo ""
-
-# Try to check if we can list installations (requires admin access)
-log_info "Checking GitHub App installations (if you have admin access)..."
-echo ""
-
-if gh api "orgs/${ORG_NAME}/installations" --jq '.[] | {id: .id, app_slug: .app_slug}' 2>/dev/null; then
-    echo ""
-    log_info "To get detailed information about an installation:"
-    echo "  gh api 'orgs/${ORG_NAME}/installations' | jq"
-else
-    log_info "Could not list installations via API (requires organization admin permissions)"
-    echo ""
-    log_info "You can still create apps via the web interface:"
-    echo "  https://github.com/organizations/${ORG_NAME}/settings/apps/new"
-fi
-
-echo ""
diff --git a/scripts/setup-github-app-arc.sh b/scripts/setup-github-app-arc.sh
deleted file mode 100755
index b7fbb7a..0000000
--- a/scripts/setup-github-app-arc.sh
+++ /dev/null
@@ -1,229 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Interactive script to guide GitHub App creation and secret setup for ARC
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-ORG_NAME="${GITHUB_ORG:-DataKnifeAI}"
-
-log_info() {
-    echo -e "${BLUE}ℹ${NC} $1"
-}
-
-log_success() {
-    echo -e "${GREEN}✓${NC} $1"
-}
-
-log_warning() {
-    echo -e "${YELLOW}⚠${NC} $1"
-}
-
-prompt() {
-    echo -e "${CYAN}?${NC} $1"
-}
-
-echo "=================================================="
-echo "  GitHub Actions Runner Controller (ARC)"
-echo "  GitHub App Setup Guide"
-echo "=================================================="
-echo ""
-
-log_info "This script will guide you through creating a GitHub App and setting up Kubernetes secrets."
-echo ""
-
-# Step 1: Check if app already exists
-prompt "Do you already have a GitHub App created? (y/n)"
-read -r HAS_APP
-
-if [[ "$HAS_APP" != "y" && "$HAS_APP" != "Y" ]]; then
-    echo ""
-    log_info "Step 1: Create GitHub App via Web Interface"
-    echo ""
-    
-    # Show name suggestions
-    if [[ -f "$SCRIPT_DIR/suggest-github-app-name.sh" ]]; then
-        "$SCRIPT_DIR/suggest-github-app-name.sh" "$ORG_NAME"
-    fi
-    
-    echo "Open this URL in your browser to create the app:"
-    echo -e "${CYAN}https://github.com/organizations/${ORG_NAME}/settings/apps/new${NC}"
-    echo ""
-    echo "Or check existing apps first:"
-    echo -e "${CYAN}https://github.com/organizations/${ORG_NAME}/settings/apps${NC}"
-    echo ""
-    echo "Configure the app with these settings:"
-    log_warning "Important: App names must be unique across ALL GitHub. Use the suggestions above if name is taken."
-    echo ""
-    echo "  • Homepage URL: https://github.com/${ORG_NAME}"
-    echo "  • Webhook: Leave unchecked"
-    echo ""
-    echo "  Repository Permissions:"
-    echo "    • Actions: Read & Write"
-    echo "    • Metadata: Read-only"
-    echo ""
-    echo "  Organization Permissions:"
-    echo "    • Self-hosted runners: Read & Write"
-    echo ""
-    echo "  • Where can this GitHub App be installed?: Only on this account"
-    echo ""
-    log_info "To check existing apps: https://github.com/organizations/${ORG_NAME}/settings/apps"
-    echo ""
-    echo "Press Enter when you've created the app (or if name was taken, choose another name and try again)..."
-    read -r
-    
-    echo ""
-    log_info "Step 2: Get App ID and Generate Private Key"
-    echo ""
-    echo "After creating the app:"
-    echo "  1. Note the App ID (visible on the app page, under the app name)"
-    echo "  2. Scroll down to 'Private keys'"
-    echo "  3. Click 'Generate a private key'"
-    echo "  4. Save the downloaded .pem file to a secure location"
-    echo ""
-    log_warning "If you see 'Name already taken' error:"
-    echo "  - Try a different name with date suffix: arc-runner-controller-$(date +%Y%m%d)"
-    echo "  - Or add environment: arc-runner-controller-nprd"
-    echo "  - Or check existing apps: https://github.com/organizations/${ORG_NAME}/settings/apps"
-    echo ""
-    echo "Press Enter when you have the App ID and private key downloaded..."
-    read -r
-    
-    echo ""
-    log_info "Step 3: Install the GitHub App"
-    echo ""
-    echo "1. On the app page, click 'Install App' (in the sidebar or top)"
-    echo "2. Select your organization: ${ORG_NAME}"
-    echo "3. Choose installation permissions (All repositories recommended for ARC)"
-    echo "4. Click 'Install'"
-    echo "5. Note the Installation ID from the URL: /installations/<INSTALLATION_ID>"
-    echo ""
-    echo "Press Enter when you've installed the app..."
-    read -r
-fi
-
-echo ""
-echo "=================================================="
-echo "  Collect App Information"
-echo "=================================================="
-echo ""
-
-# Collect App ID
-prompt "Enter GitHub App ID:"
-read -r APP_ID
-if [[ -z "$APP_ID" ]]; then
-    log_warning "App ID cannot be empty. Exiting."
-    exit 1
-fi
-
-# Collect Installation ID
-prompt "Enter GitHub App Installation ID:"
-read -r INSTALLATION_ID
-if [[ -z "$INSTALLATION_ID" ]]; then
-    log_warning "Installation ID cannot be empty. Exiting."
-    exit 1
-fi
-
-# Collect private key path
-prompt "Enter path to GitHub App private key (.pem file):"
-read -r PRIVATE_KEY_PATH
-if [[ ! -f "$PRIVATE_KEY_PATH" ]]; then
-    log_warning "Private key file not found: $PRIVATE_KEY_PATH"
-    exit 1
-fi
-
-# Collect cluster
-echo ""
-prompt "Which cluster(s) should we set up secrets for?"
-echo "  1) nprd-apps only"
-echo "  2) prd-apps only"
-echo "  3) Both clusters"
-read -r CLUSTER_CHOICE
-
-case "$CLUSTER_CHOICE" in
-    1)
-        CLUSTERS=("nprd-apps")
-        ;;
-    2)
-        CLUSTERS=("prd-apps")
-        ;;
-    3)
-        CLUSTERS=("nprd-apps" "prd-apps")
-        ;;
-    *)
-        log_warning "Invalid choice. Exiting."
-        exit 1
-        ;;
-esac
-
-# Collect namespace for runner secret
-prompt "Enter namespace for runner secret (default: managed-cicd):"
-read -r RUNNER_NAMESPACE
-RUNNER_NAMESPACE="${RUNNER_NAMESPACE:-managed-cicd}"
-
-echo ""
-echo "=================================================="
-echo "  Create Kubernetes Secrets"
-echo "=================================================="
-echo ""
-
-# Verify app access using gh CLI
-log_info "Verifying GitHub App access..."
-if gh api "app/installations/${INSTALLATION_ID}" &>/dev/null; then
-    log_success "GitHub App installation found"
-else
-    log_warning "Could not verify installation access via API (this is OK if you don't have admin access)"
-fi
-
-# Create secrets for each cluster
-for CLUSTER in "${CLUSTERS[@]}"; do
-    echo ""
-    log_info "Setting up secrets for cluster: $CLUSTER"
-    echo ""
-    
-    # Call the secret creation script
-    "$SCRIPT_DIR/create-github-app-secrets.sh" \
-        -c "$CLUSTER" \
-        -i "$APP_ID" \
-        -n "$INSTALLATION_ID" \
-        -k "$PRIVATE_KEY_PATH" \
-        || {
-            log_warning "Failed to create secrets for $CLUSTER"
-            continue
-        }
-done
-
-echo ""
-echo "=================================================="
-echo "  Setup Complete!"
-echo "=================================================="
-echo ""
-
-log_success "GitHub App secrets have been created for: ${CLUSTERS[*]}"
-echo ""
-echo "Next steps:"
-echo "  1. Ensure your AutoscalingRunnerSet resource references the secret:"
-echo "     spec.githubConfigSecret: github-app-secret"
-echo ""
-echo "  2. Verify controller pods are running:"
-for CLUSTER in "${CLUSTERS[@]}"; do
-    echo "     kubectl --kubeconfig ~/.kube/${CLUSTER}.yaml get pods -n actions-runner-system"
-done
-echo ""
-echo "  3. Check controller logs for any errors:"
-for CLUSTER in "${CLUSTERS[@]}"; do
-    echo "     kubectl --kubeconfig ~/.kube/${CLUSTER}.yaml logs -n actions-runner-system \\"
-    echo "       -l app.kubernetes.io/name=gha-runner-scale-set-controller --tail=50"
-done
-echo ""
-echo "  4. Once the AutoscalingRunnerSet is deployed, check runner status:"
-echo "     kubectl get autoscalingrunnersets -n ${RUNNER_NAMESPACE}"
-echo ""
diff --git a/scripts/suggest-github-app-name.sh b/scripts/suggest-github-app-name.sh
deleted file mode 100755
index 45b9957..0000000
--- a/scripts/suggest-github-app-name.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# Suggest unique GitHub App names to avoid conflicts
-
-ORG_NAME="${1:-${GITHUB_ORG:-DataKnifeAI}}"
-ENV="${2:-}"
-
-CYAN='\033[0;36m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-echo "=================================================="
-echo "  Suggested GitHub App Names"
-echo "=================================================="
-echo ""
-
-echo -e "${CYAN}GitHub App names must be unique across ALL GitHub accounts.${NC}"
-echo -e "${YELLOW}If a name is taken, try the next suggestion.${NC}"
-echo ""
-
-ORG_LOWER=$(echo "$ORG_NAME" | tr '[:upper:]' '[:lower:]')
-DATE_SUFFIX=$(date +%Y%m%d)
-DATE_SHORT=$(date +%m%d)
-
-echo "Suggested names (in order of preference):"
-echo ""
-echo -e "${GREEN}1.${NC} arc-runner-controller-${ORG_LOWER}${ENV:+-$ENV}"
-echo -e "   → Most descriptive, includes organization"
-echo ""
-echo -e "${GREEN}2.${NC} arc-runner-controller-${ORG_LOWER}-${DATE_SUFFIX}"
-echo -e "   → Includes date to ensure uniqueness"
-echo ""
-echo -e "${GREEN}3.${NC} arc-runner-controller-${ORG_LOWER}-${DATE_SHORT}${ENV:+-$ENV}"
-echo -e "   → Shorter date format"
-echo ""
-echo -e "${GREEN}4.${NC} ${ORG_LOWER}-arc-runner-controller${ENV:+-$ENV}"
-echo -e "   → Organization-first format"
-echo ""
-echo -e "${GREEN}5.${NC} arc-runner-${ORG_LOWER}${ENV:+-$ENV}"
-echo -e "   → Shorter format"
-echo ""
-
-if [[ -n "$ENV" ]]; then
-    echo "Environment-specific suggestions:"
-    echo -e "${GREEN}6.${NC} arc-runner-controller-${ENV}-${ORG_LOWER}"
-    echo -e "${GREEN}7.${NC} ${ORG_LOWER}-arc-${ENV}"
-    echo ""
-fi
-
-echo "Tips:"
-echo "  • Try names in order (1-7)"
-echo "  • If all are taken, add more unique suffixes:"
-echo "    - Your username: arc-runner-controller-${ORG_LOWER}-$(whoami 2>/dev/null || echo 'yourname')"
-echo "    - Random suffix: arc-runner-controller-${ORG_LOWER}-$(openssl rand -hex 4 2>/dev/null || echo 'abcd1234')"
-echo ""
-echo "Check existing apps:"
-echo "  https://github.com/organizations/${ORG_NAME}/settings/apps"
-echo ""
diff --git a/terraform/main.tf b/terraform/main.tf
index 8250fd8..6075ce4 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -3098,1376 +3098,3 @@ resource "null_resource" "deploy_cloudnativepg_poc_apps" {
     cnpg_version = var.cloudnativepg_operator_version
   }
 }
-
-# ============================================================================
-# MONGODB COMMUNITY OPERATOR DEPLOYMENT
-# Installs MongoDB Community Operator CRDs and operator for MongoDB management
-# Required for Graylog Helm chart deployments
-# Deploys to nprd-apps, prd-apps, and poc-apps clusters
-# ============================================================================
-
-resource "null_resource" "deploy_mongodb_community_operator_nprd_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying MongoDB Community Operator to NPRD Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to nprd-apps cluster
-      export KUBECONFIG="$HOME/.kube/nprd-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access nprd-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # MongoDB Community Operator configuration
-      MONGODB_NAMESPACE="mongodb"
-      MONGODB_RELEASE_NAME="community-operator"
-      MONGODB_CHART="mongodb/community-operator"
-      MONGODB_HELM_REPO="https://mongodb.github.io/helm-charts"
-      MONGODB_VERSION="${var.mongodb_operator_version}"
-      
-      # Add MongoDB Helm repository
-      echo "Adding MongoDB Helm repository..."
-      helm repo add mongodb "$${MONGODB_HELM_REPO}" 2>/dev/null || echo "Repository already added"
-      helm repo update
-      echo "✓ Helm repository added and updated"
-      
-      # Clean up any existing CRDs that were installed manually (if present)
-      # This is needed if a previous installation attempt failed
-      echo "Checking for existing CRDs from previous installation..."
-      if kubectl get crd mongodbcommunity.mongodbcommunity.mongodb.com &>/dev/null; then
-        # Check if it's managed by Helm
-        if ! kubectl get crd mongodbcommunity.mongodbcommunity.mongodb.com -o jsonpath='{.metadata.labels.app\.kubernetes\.io/managed-by}' 2>/dev/null | grep -q "Helm"; then
-          echo "  Removing manually installed CRD (will be installed by Helm)..."
-          kubectl delete crd mongodbcommunity.mongodbcommunity.mongodb.com --ignore-not-found=true || true
-          sleep 2
-        fi
-      fi
-      
-      # Install MongoDB Community Operator via Helm
-      # Note: CRDs are installed automatically by the Helm chart
-      # Configure operator to watch all namespaces (required for MongoDBCommunity resources in other namespaces)
-      echo "Installing MongoDB Community Operator version $${MONGODB_VERSION}..."
-      if helm list -n "$${MONGODB_NAMESPACE}" 2>/dev/null | grep -q "^$${MONGODB_RELEASE_NAME}\\s"; then
-        echo "  MongoDB Community Operator already installed, upgrading to version $${MONGODB_VERSION}..."
-        helm upgrade "$${MONGODB_RELEASE_NAME}" "$${MONGODB_CHART}" \
-          --namespace "$${MONGODB_NAMESPACE}" \
-          --version "$${MONGODB_VERSION}" \
-          --set operator.watchNamespace='*' \
-          --wait \
-          --timeout 10m
-      else
-        echo "  Installing MongoDB Community Operator version $${MONGODB_VERSION}..."
-        helm install "$${MONGODB_RELEASE_NAME}" "$${MONGODB_CHART}" \
-          --namespace "$${MONGODB_NAMESPACE}" \
-          --create-namespace \
-          --version "$${MONGODB_VERSION}" \
-          --set operator.watchNamespace='*' \
-          --wait \
-          --timeout 10m
-      fi
-      
-      echo "✓ MongoDB Community Operator installed"
-      
-      # Wait for operator pods to be ready
-      echo "Waiting for operator pods to be ready..."
-      sleep 5
-      kubectl wait --for=condition=ready pod --all -n "$${MONGODB_NAMESPACE}" --timeout=5m 2>/dev/null || {
-        echo "⚠ Some pods may still be starting"
-      }
-      
-      # Verify installation
-      echo ""
-      echo "Verifying MongoDB Community Operator installation..."
-      DEPLOYMENT_NAME=$(kubectl get deployment -n "$${MONGODB_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-      if [ -n "$${DEPLOYMENT_NAME}" ]; then
-        kubectl rollout status "deployment/$${DEPLOYMENT_NAME}" -n "$${MONGODB_NAMESPACE}" --timeout=5m || true
-      fi
-      
-      echo ""
-      echo "MongoDB Community Operator Pods:"
-      kubectl get pods -n "$${MONGODB_NAMESPACE}"
-      
-      echo ""
-      echo "MongoDB Community Operator CRDs:"
-      kubectl get crd | grep mongodbcommunity || echo "CRDs may still be installing..."
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ MongoDB Community Operator deployment complete"
-      echo "=========================================="
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing MongoDB Community Operator from NPRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/nprd-apps.yaml"
-      
-      if kubectl get namespace mongodb &>/dev/null; then
-        echo "Removing MongoDB Community Operator..."
-        helm uninstall community-operator -n mongodb 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace mongodb --timeout=2m 2>/dev/null || true
-        
-        echo "✓ MongoDB Community Operator removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_nprd_apps
-  ]
-
-  triggers = {
-    mongodb_operator_version = var.mongodb_operator_version
-  }
-}
-
-resource "null_resource" "deploy_mongodb_community_operator_prd_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying MongoDB Community Operator to PRD Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to prd-apps cluster
-      export KUBECONFIG="$HOME/.kube/prd-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access prd-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # MongoDB Community Operator configuration
-      MONGODB_NAMESPACE="mongodb"
-      MONGODB_RELEASE_NAME="community-operator"
-      MONGODB_CHART="mongodb/community-operator"
-      MONGODB_HELM_REPO="https://mongodb.github.io/helm-charts"
-      MONGODB_VERSION="${var.mongodb_operator_version}"
-      
-      # Add MongoDB Helm repository
-      echo "Adding MongoDB Helm repository..."
-      helm repo add mongodb "$${MONGODB_HELM_REPO}" 2>/dev/null || echo "Repository already added"
-      helm repo update
-      echo "✓ Helm repository added and updated"
-      
-      # Clean up any existing CRDs that were installed manually (if present)
-      # This is needed if a previous installation attempt failed
-      echo "Checking for existing CRDs from previous installation..."
-      if kubectl get crd mongodbcommunity.mongodbcommunity.mongodb.com &>/dev/null; then
-        # Check if it's managed by Helm
-        if ! kubectl get crd mongodbcommunity.mongodbcommunity.mongodb.com -o jsonpath='{.metadata.labels.app\.kubernetes\.io/managed-by}' 2>/dev/null | grep -q "Helm"; then
-          echo "  Removing manually installed CRD (will be installed by Helm)..."
-          kubectl delete crd mongodbcommunity.mongodbcommunity.mongodb.com --ignore-not-found=true || true
-          sleep 2
-        fi
-      fi
-      
-      # Install MongoDB Community Operator via Helm
-      # Note: CRDs are installed automatically by the Helm chart
-      # Configure operator to watch all namespaces (required for MongoDBCommunity resources in other namespaces)
-      echo "Installing MongoDB Community Operator version $${MONGODB_VERSION}..."
-      if helm list -n "$${MONGODB_NAMESPACE}" 2>/dev/null | grep -q "^$${MONGODB_RELEASE_NAME}\\s"; then
-        echo "  MongoDB Community Operator already installed, upgrading to version $${MONGODB_VERSION}..."
-        helm upgrade "$${MONGODB_RELEASE_NAME}" "$${MONGODB_CHART}" \
-          --namespace "$${MONGODB_NAMESPACE}" \
-          --version "$${MONGODB_VERSION}" \
-          --set operator.watchNamespace='*' \
-          --wait \
-          --timeout 10m
-      else
-        echo "  Installing MongoDB Community Operator version $${MONGODB_VERSION}..."
-        helm install "$${MONGODB_RELEASE_NAME}" "$${MONGODB_CHART}" \
-          --namespace "$${MONGODB_NAMESPACE}" \
-          --create-namespace \
-          --version "$${MONGODB_VERSION}" \
-          --set operator.watchNamespace='*' \
-          --wait \
-          --timeout 10m
-      fi
-      
-      echo "✓ MongoDB Community Operator installed"
-      
-      # Wait for operator pods to be ready
-      echo "Waiting for operator pods to be ready..."
-      sleep 5
-      kubectl wait --for=condition=ready pod --all -n "$${MONGODB_NAMESPACE}" --timeout=5m 2>/dev/null || {
-        echo "⚠ Some pods may still be starting"
-      }
-      
-      # Verify installation
-      echo ""
-      echo "Verifying MongoDB Community Operator installation..."
-      DEPLOYMENT_NAME=$(kubectl get deployment -n "$${MONGODB_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-      if [ -n "$${DEPLOYMENT_NAME}" ]; then
-        kubectl rollout status "deployment/$${DEPLOYMENT_NAME}" -n "$${MONGODB_NAMESPACE}" --timeout=5m || true
-      fi
-      
-      echo ""
-      echo "MongoDB Community Operator Pods:"
-      kubectl get pods -n "$${MONGODB_NAMESPACE}"
-      
-      echo ""
-      echo "MongoDB Community Operator CRDs:"
-      kubectl get crd | grep mongodbcommunity || echo "CRDs may still be installing..."
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ MongoDB Community Operator deployment complete"
-      echo "=========================================="
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing MongoDB Community Operator from PRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/prd-apps.yaml"
-      
-      if kubectl get namespace mongodb &>/dev/null; then
-        echo "Removing MongoDB Community Operator..."
-        helm uninstall community-operator -n mongodb 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace mongodb --timeout=2m 2>/dev/null || true
-        
-        echo "✓ MongoDB Community Operator removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_prd_apps
-  ]
-
-  triggers = {
-    mongodb_operator_version = var.mongodb_operator_version
-  }
-}
-
-resource "null_resource" "deploy_mongodb_community_operator_poc_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying MongoDB Community Operator to POC Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to poc-apps cluster
-      export KUBECONFIG="$HOME/.kube/poc-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access poc-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # MongoDB Community Operator configuration
-      MONGODB_NAMESPACE="mongodb"
-      MONGODB_RELEASE_NAME="community-operator"
-      MONGODB_CHART="mongodb/community-operator"
-      MONGODB_HELM_REPO="https://mongodb.github.io/helm-charts"
-      MONGODB_VERSION="${var.mongodb_operator_version}"
-      
-      # Add MongoDB Helm repository
-      echo "Adding MongoDB Helm repository..."
-      helm repo add mongodb "$${MONGODB_HELM_REPO}" 2>/dev/null || echo "Repository already added"
-      helm repo update
-      echo "✓ Helm repository added and updated"
-      
-      # Clean up any existing CRDs that were installed manually (if present)
-      # This is needed if a previous installation attempt failed
-      echo "Checking for existing CRDs from previous installation..."
-      if kubectl get crd mongodbcommunity.mongodbcommunity.mongodb.com &>/dev/null; then
-        # Check if it's managed by Helm
-        if ! kubectl get crd mongodbcommunity.mongodbcommunity.mongodb.com -o jsonpath='{.metadata.labels.app\.kubernetes\.io/managed-by}' 2>/dev/null | grep -q "Helm"; then
-          echo "  Removing manually installed CRD (will be installed by Helm)..."
-          kubectl delete crd mongodbcommunity.mongodbcommunity.mongodb.com --ignore-not-found=true || true
-          sleep 2
-        fi
-      fi
-      
-      # Install MongoDB Community Operator via Helm
-      # Note: CRDs are installed automatically by the Helm chart
-      # Configure operator to watch all namespaces (required for MongoDBCommunity resources in other namespaces)
-      echo "Installing MongoDB Community Operator version $${MONGODB_VERSION}..."
-      if helm list -n "$${MONGODB_NAMESPACE}" 2>/dev/null | grep -q "^$${MONGODB_RELEASE_NAME}\\s"; then
-        echo "  MongoDB Community Operator already installed, upgrading to version $${MONGODB_VERSION}..."
-        helm upgrade "$${MONGODB_RELEASE_NAME}" "$${MONGODB_CHART}" \
-          --namespace "$${MONGODB_NAMESPACE}" \
-          --version "$${MONGODB_VERSION}" \
-          --set operator.watchNamespace='*' \
-          --wait \
-          --timeout 10m
-      else
-        echo "  Installing MongoDB Community Operator version $${MONGODB_VERSION}..."
-        helm install "$${MONGODB_RELEASE_NAME}" "$${MONGODB_CHART}" \
-          --namespace "$${MONGODB_NAMESPACE}" \
-          --create-namespace \
-          --version "$${MONGODB_VERSION}" \
-          --set operator.watchNamespace='*' \
-          --wait \
-          --timeout 10m
-      fi
-      
-      echo "✓ MongoDB Community Operator installed"
-      
-      # Wait for operator pods to be ready
-      echo "Waiting for operator pods to be ready..."
-      sleep 5
-      kubectl wait --for=condition=ready pod --all -n "$${MONGODB_NAMESPACE}" --timeout=5m 2>/dev/null || {
-        echo "⚠ Some pods may still be starting"
-      }
-      
-      # Verify installation
-      echo ""
-      echo "Verifying MongoDB Community Operator installation..."
-      DEPLOYMENT_NAME=$(kubectl get deployment -n "$${MONGODB_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-      if [ -n "$${DEPLOYMENT_NAME}" ]; then
-        kubectl rollout status "deployment/$${DEPLOYMENT_NAME}" -n "$${MONGODB_NAMESPACE}" --timeout=5m || true
-      fi
-      
-      echo ""
-      echo "MongoDB Community Operator Pods:"
-      kubectl get pods -n "$${MONGODB_NAMESPACE}"
-      
-      echo ""
-      echo "MongoDB Community Operator CRDs:"
-      kubectl get crd | grep mongodbcommunity || echo "CRDs may still be installing..."
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ MongoDB Community Operator deployment complete"
-      echo "=========================================="
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing MongoDB Community Operator from POC Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/poc-apps.yaml"
-      
-      if kubectl get namespace mongodb &>/dev/null; then
-        echo "Removing MongoDB Community Operator..."
-        helm uninstall community-operator -n mongodb 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace mongodb --timeout=2m 2>/dev/null || true
-        
-        echo "✓ MongoDB Community Operator removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_poc_apps
-  ]
-
-  triggers = {
-    mongodb_operator_version = var.mongodb_operator_version
-  }
-}
-
-# ============================================================================
-# OPENSEARCH OPERATOR DEPLOYMENT
-# Installs OpenSearch Kubernetes Operator for OpenSearch cluster management
-# Deploys to nprd-apps, prd-apps, and poc-apps clusters
-# ============================================================================
-
-resource "null_resource" "deploy_opensearch_operator_nprd_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying OpenSearch Operator to NPRD Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to nprd-apps cluster
-      export KUBECONFIG="$HOME/.kube/nprd-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access nprd-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # OpenSearch Operator configuration
-      OPENSEARCH_NAMESPACE="opensearch-operator-system"
-      OPENSEARCH_RELEASE_NAME="opensearch-operator"
-      OPENSEARCH_CHART="opensearch-operator/opensearch-operator"
-      OPENSEARCH_HELM_REPO="https://opensearch-project.github.io/opensearch-k8s-operator/"
-      OPENSEARCH_VERSION="${var.opensearch_operator_version}"
-      
-      # Add OpenSearch Helm repository
-      echo "Adding OpenSearch Helm repository..."
-      helm repo add opensearch-operator "$${OPENSEARCH_HELM_REPO}" 2>/dev/null || echo "Repository already added"
-      helm repo update
-      echo "✓ Helm repository added and updated"
-      
-      # Install OpenSearch Operator via Helm
-      # Note: CRDs are installed automatically by the Helm chart
-      echo "Installing OpenSearch Operator version $${OPENSEARCH_VERSION}..."
-      if helm list -n "$${OPENSEARCH_NAMESPACE}" 2>/dev/null | grep -q "^$${OPENSEARCH_RELEASE_NAME}\\s"; then
-        echo "  OpenSearch Operator already installed, upgrading to version $${OPENSEARCH_VERSION}..."
-        helm upgrade "$${OPENSEARCH_RELEASE_NAME}" "$${OPENSEARCH_CHART}" \
-          --namespace "$${OPENSEARCH_NAMESPACE}" \
-          --version "$${OPENSEARCH_VERSION}" \
-          --wait \
-          --timeout 10m
-      else
-        echo "  Installing OpenSearch Operator version $${OPENSEARCH_VERSION}..."
-        helm install "$${OPENSEARCH_RELEASE_NAME}" "$${OPENSEARCH_CHART}" \
-          --namespace "$${OPENSEARCH_NAMESPACE}" \
-          --create-namespace \
-          --version "$${OPENSEARCH_VERSION}" \
-          --wait \
-          --timeout 10m
-      fi
-      
-      echo "✓ OpenSearch Operator installed"
-      
-      # Wait for operator pods to be ready
-      echo "Waiting for operator pods to be ready..."
-      sleep 5
-      kubectl wait --for=condition=ready pod --all -n "$${OPENSEARCH_NAMESPACE}" --timeout=5m 2>/dev/null || {
-        echo "⚠ Some pods may still be starting"
-      }
-      
-      # Verify installation
-      echo ""
-      echo "Verifying OpenSearch Operator installation..."
-      DEPLOYMENT_NAME=$(kubectl get deployment -n "$${OPENSEARCH_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-      if [ -n "$${DEPLOYMENT_NAME}" ]; then
-        kubectl rollout status "deployment/$${DEPLOYMENT_NAME}" -n "$${OPENSEARCH_NAMESPACE}" --timeout=5m || true
-      fi
-      
-      echo ""
-      echo "OpenSearch Operator Pods:"
-      kubectl get pods -n "$${OPENSEARCH_NAMESPACE}"
-      
-      echo ""
-      echo "OpenSearch Operator CRDs:"
-      kubectl get crd | grep opensearch || echo "CRDs may still be installing..."
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ OpenSearch Operator deployment complete"
-      echo "=========================================="
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing OpenSearch Operator from NPRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/nprd-apps.yaml"
-      
-      if kubectl get namespace opensearch-operator-system &>/dev/null; then
-        echo "Removing OpenSearch Operator..."
-        helm uninstall opensearch-operator -n opensearch-operator-system 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace opensearch-operator-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ OpenSearch Operator removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_nprd_apps
-  ]
-
-  triggers = {
-    opensearch_operator_version = var.opensearch_operator_version
-  }
-}
-
-resource "null_resource" "deploy_opensearch_operator_prd_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying OpenSearch Operator to PRD Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to prd-apps cluster
-      export KUBECONFIG="$HOME/.kube/prd-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access prd-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # OpenSearch Operator configuration
-      OPENSEARCH_NAMESPACE="opensearch-operator-system"
-      OPENSEARCH_RELEASE_NAME="opensearch-operator"
-      OPENSEARCH_CHART="opensearch-operator/opensearch-operator"
-      OPENSEARCH_HELM_REPO="https://opensearch-project.github.io/opensearch-k8s-operator/"
-      OPENSEARCH_VERSION="${var.opensearch_operator_version}"
-      
-      # Add OpenSearch Helm repository
-      echo "Adding OpenSearch Helm repository..."
-      helm repo add opensearch-operator "$${OPENSEARCH_HELM_REPO}" 2>/dev/null || echo "Repository already added"
-      helm repo update
-      echo "✓ Helm repository added and updated"
-      
-      # Install OpenSearch Operator via Helm
-      # Note: CRDs are installed automatically by the Helm chart
-      echo "Installing OpenSearch Operator version $${OPENSEARCH_VERSION}..."
-      if helm list -n "$${OPENSEARCH_NAMESPACE}" 2>/dev/null | grep -q "^$${OPENSEARCH_RELEASE_NAME}\\s"; then
-        echo "  OpenSearch Operator already installed, upgrading to version $${OPENSEARCH_VERSION}..."
-        helm upgrade "$${OPENSEARCH_RELEASE_NAME}" "$${OPENSEARCH_CHART}" \
-          --namespace "$${OPENSEARCH_NAMESPACE}" \
-          --version "$${OPENSEARCH_VERSION}" \
-          --wait \
-          --timeout 10m
-      else
-        echo "  Installing OpenSearch Operator version $${OPENSEARCH_VERSION}..."
-        helm install "$${OPENSEARCH_RELEASE_NAME}" "$${OPENSEARCH_CHART}" \
-          --namespace "$${OPENSEARCH_NAMESPACE}" \
-          --create-namespace \
-          --version "$${OPENSEARCH_VERSION}" \
-          --wait \
-          --timeout 10m
-      fi
-      
-      echo "✓ OpenSearch Operator installed"
-      
-      # Wait for operator pods to be ready
-      echo "Waiting for operator pods to be ready..."
-      sleep 5
-      kubectl wait --for=condition=ready pod --all -n "$${OPENSEARCH_NAMESPACE}" --timeout=5m 2>/dev/null || {
-        echo "⚠ Some pods may still be starting"
-      }
-      
-      # Verify installation
-      echo ""
-      echo "Verifying OpenSearch Operator installation..."
-      DEPLOYMENT_NAME=$(kubectl get deployment -n "$${OPENSEARCH_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-      if [ -n "$${DEPLOYMENT_NAME}" ]; then
-        kubectl rollout status "deployment/$${DEPLOYMENT_NAME}" -n "$${OPENSEARCH_NAMESPACE}" --timeout=5m || true
-      fi
-      
-      echo ""
-      echo "OpenSearch Operator Pods:"
-      kubectl get pods -n "$${OPENSEARCH_NAMESPACE}"
-      
-      echo ""
-      echo "OpenSearch Operator CRDs:"
-      kubectl get crd | grep opensearch || echo "CRDs may still be installing..."
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ OpenSearch Operator deployment complete"
-      echo "=========================================="
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing OpenSearch Operator from PRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/prd-apps.yaml"
-      
-      if kubectl get namespace opensearch-operator-system &>/dev/null; then
-        echo "Removing OpenSearch Operator..."
-        helm uninstall opensearch-operator -n opensearch-operator-system 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace opensearch-operator-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ OpenSearch Operator removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_prd_apps
-  ]
-
-  triggers = {
-    opensearch_operator_version = var.opensearch_operator_version
-  }
-}
-
-resource "null_resource" "deploy_opensearch_operator_poc_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying OpenSearch Operator to POC Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to poc-apps cluster
-      export KUBECONFIG="$HOME/.kube/poc-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access poc-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # OpenSearch Operator configuration
-      OPENSEARCH_NAMESPACE="opensearch-operator-system"
-      OPENSEARCH_RELEASE_NAME="opensearch-operator"
-      OPENSEARCH_CHART="opensearch-operator/opensearch-operator"
-      OPENSEARCH_HELM_REPO="https://opensearch-project.github.io/opensearch-k8s-operator/"
-      OPENSEARCH_VERSION="${var.opensearch_operator_version}"
-      
-      # Add OpenSearch Helm repository
-      echo "Adding OpenSearch Helm repository..."
-      helm repo add opensearch-operator "$${OPENSEARCH_HELM_REPO}" 2>/dev/null || echo "Repository already added"
-      helm repo update
-      echo "✓ Helm repository added and updated"
-      
-      # Install OpenSearch Operator via Helm
-      # Note: CRDs are installed automatically by the Helm chart
-      echo "Installing OpenSearch Operator version $${OPENSEARCH_VERSION}..."
-      if helm list -n "$${OPENSEARCH_NAMESPACE}" 2>/dev/null | grep -q "^$${OPENSEARCH_RELEASE_NAME}\\s"; then
-        echo "  OpenSearch Operator already installed, upgrading to version $${OPENSEARCH_VERSION}..."
-        helm upgrade "$${OPENSEARCH_RELEASE_NAME}" "$${OPENSEARCH_CHART}" \
-          --namespace "$${OPENSEARCH_NAMESPACE}" \
-          --version "$${OPENSEARCH_VERSION}" \
-          --wait \
-          --timeout 10m
-      else
-        echo "  Installing OpenSearch Operator version $${OPENSEARCH_VERSION}..."
-        helm install "$${OPENSEARCH_RELEASE_NAME}" "$${OPENSEARCH_CHART}" \
-          --namespace "$${OPENSEARCH_NAMESPACE}" \
-          --create-namespace \
-          --version "$${OPENSEARCH_VERSION}" \
-          --wait \
-          --timeout 10m
-      fi
-      
-      echo "✓ OpenSearch Operator installed"
-      
-      # Wait for operator pods to be ready
-      echo "Waiting for operator pods to be ready..."
-      sleep 5
-      kubectl wait --for=condition=ready pod --all -n "$${OPENSEARCH_NAMESPACE}" --timeout=5m 2>/dev/null || {
-        echo "⚠ Some pods may still be starting"
-      }
-      
-      # Verify installation
-      echo ""
-      echo "Verifying OpenSearch Operator installation..."
-      DEPLOYMENT_NAME=$(kubectl get deployment -n "$${OPENSEARCH_NAMESPACE}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-      if [ -n "$${DEPLOYMENT_NAME}" ]; then
-        kubectl rollout status "deployment/$${DEPLOYMENT_NAME}" -n "$${OPENSEARCH_NAMESPACE}" --timeout=5m || true
-      fi
-      
-      echo ""
-      echo "OpenSearch Operator Pods:"
-      kubectl get pods -n "$${OPENSEARCH_NAMESPACE}"
-      
-      echo ""
-      echo "OpenSearch Operator CRDs:"
-      kubectl get crd | grep opensearch || echo "CRDs may still be installing..."
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ OpenSearch Operator deployment complete"
-      echo "=========================================="
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing OpenSearch Operator from POC Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$${HOME}/.kube/poc-apps.yaml"
-      
-      if kubectl get namespace opensearch-operator-system &>/dev/null; then
-        echo "Removing OpenSearch Operator..."
-        helm uninstall opensearch-operator -n opensearch-operator-system 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace opensearch-operator-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ OpenSearch Operator removed"
-      else
-        echo "✓ Namespace already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_poc_apps
-  ]
-
-  triggers = {
-    opensearch_operator_version = var.opensearch_operator_version
-  }
-}
-
-# ============================================================================
-# GITHUB ACTIONS RUNNER CONTROLLER (ARC) DEPLOYMENT
-# Installs ARC controller for GitHub Actions runner management
-# Deploys to nprd-apps, prd-apps, and poc-apps clusters
-# Required before Fleet processes AutoscalingRunnerSet resources (official GitHub version)
-# ============================================================================
-
-resource "null_resource" "deploy_arc_nprd_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying Official GitHub ARC Controller to NPRD Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to nprd-apps cluster
-      export KUBECONFIG="$HOME/.kube/nprd-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access nprd-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # Official GitHub ARC uses OCI registry (no Helm repo needed)
-      echo "Using official GitHub OCI chart (no Helm repo needed)"
-      
-      # Install official ARC controller using OCI chart
-      echo "Installing official GitHub ARC controller version ${var.github_arc_controller_version}..."
-      NAMESPACE="actions-runner-system"
-      RELEASE_NAME="gha-runner-scale-set-controller"
-      CHART="oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller"
-      ARC_VERSION="${var.github_arc_controller_version}"
-      
-      # Check if already installed
-      if helm list -n "$${NAMESPACE}" 2>/dev/null | grep -q "^$${RELEASE_NAME}\\s"; then
-        echo "  ARC controller already installed, upgrading to version $${ARC_VERSION}..."
-        helm upgrade "$${RELEASE_NAME}" "$${CHART}" \
-          --namespace "$${NAMESPACE}" \
-          --version "$${ARC_VERSION}" \
-          --wait=false
-      else
-        echo "  Installing official ARC controller version $${ARC_VERSION}..."
-        helm install "$${RELEASE_NAME}" "$${CHART}" \
-          --namespace "$${NAMESPACE}" \
-          --create-namespace \
-          --version "$${ARC_VERSION}" \
-          --wait=false
-      fi
-      
-      echo "✓ Official ARC controller installed (version $${ARC_VERSION})"
-      
-      # Wait a moment for CRDs to be created
-      sleep 5
-      
-      # Verify CRDs are installed (these are what Fleet needs)
-      echo ""
-      echo "Verifying ARC CRDs installation (Official Version)..."
-      if kubectl get crd autoscalingrunnersets.actions.github.com &>/dev/null; then
-        echo "✓ Required CRDs installed:"
-        kubectl get crd | grep -E "autoscalingrunnersets|ephemeralrunnersets|ephemeralrunners" || true
-      else
-        echo "⚠ CRDs may still be installing, but controller chart is installed"
-      fi
-      
-      echo ""
-      echo "ARC Controller Pods:"
-      kubectl get pods -n "$${NAMESPACE}" -l app.kubernetes.io/name=gha-runner-scale-set-controller || echo "Pods may still be starting..."
-      
-      echo ""
-      echo "=========================================="
-      echo "Configuring RBAC for ARC Controller"
-      echo "=========================================="
-      
-      # Ensure managed-cicd namespace exists
-      RUNNER_NAMESPACE="managed-cicd"
-      if ! kubectl get namespace "$${RUNNER_NAMESPACE}" &>/dev/null; then
-        echo "Creating namespace: $${RUNNER_NAMESPACE}"
-        kubectl create namespace "$${RUNNER_NAMESPACE}" || true
-      fi
-      
-      # Wait for controller ServiceAccount to be created
-      echo "Waiting for controller ServiceAccount..."
-      CONTROLLER_SA="gha-runner-scale-set-controller-gha-rs-controller"
-      for i in {1..30}; do
-        if kubectl get serviceaccount "$${CONTROLLER_SA}" -n "$${NAMESPACE}" &>/dev/null; then
-          echo "✓ Controller ServiceAccount found"
-          break
-        fi
-        if [ $i -eq 30 ]; then
-          echo "⚠ Warning: Controller ServiceAccount not found, but continuing..."
-        fi
-        sleep 2
-      done
-      
-      # Create Role for managing secrets and RBAC in managed-cicd namespace
-      # The controller needs to:
-      # 1. Read/create secrets (for github-app-secret authentication and listener config)
-      # 2. Create/manage Roles and RoleBindings (for AutoscalingListener pods)
-      echo "Creating Role for secret and RBAC access in $${RUNNER_NAMESPACE} namespace..."
-      kubectl apply -f - <<EOF
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: arc-controller-secret-reader
-  namespace: $${RUNNER_NAMESPACE}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "list", "watch", "create", "update", "patch"]
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["roles", "rolebindings"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-EOF
-      
-      # Create RoleBinding to grant controller ServiceAccount permission to read secrets
-      echo "Creating RoleBinding for controller secret access..."
-      kubectl apply -f - <<EOF
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: arc-controller-secret-reader
-  namespace: $${RUNNER_NAMESPACE}
-subjects:
-- kind: ServiceAccount
-  name: $${CONTROLLER_SA}
-  namespace: $${NAMESPACE}
-roleRef:
-  kind: Role
-  name: arc-controller-secret-reader
-  apiGroup: rbac.authorization.k8s.io
-EOF
-      
-      echo "✓ RBAC configured: Controller can now read secrets in $${RUNNER_NAMESPACE} namespace"
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ Official ARC deployment complete"
-      echo "=========================================="
-      echo ""
-      echo "Note: CRDs are installed immediately. Fleet can now validate"
-      echo "AutoscalingRunnerSet resources (official GitHub version)."
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing GitHub ARC Controller from NPRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$HOME/.kube/nprd-apps.yaml"
-      
-      if helm list -n actions-runner-system 2>/dev/null | grep -qE "(actions-runner-controller|gha-runner-scale-set-controller)"; then
-        echo "Uninstalling ARC controller..."
-        helm uninstall actions-runner-controller -n actions-runner-system 2>/dev/null || true
-        helm uninstall gha-runner-scale-set-controller -n actions-runner-system 2>/dev/null || true
-        
-        echo "Cleaning up RBAC resources..."
-        kubectl delete rolebinding arc-controller-secret-reader -n managed-cicd 2>/dev/null || true
-        kubectl delete role arc-controller-secret-reader -n managed-cicd 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace actions-runner-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ ARC controller removed"
-      else
-        echo "✓ ARC controller already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_nprd_apps
-  ]
-
-  triggers = {
-    arc_chart_version = var.github_arc_controller_version
-  }
-}
-
-resource "null_resource" "deploy_arc_prd_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying Official GitHub ARC Controller to PRD Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to prd-apps cluster
-      export KUBECONFIG="$HOME/.kube/prd-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access prd-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # Official GitHub ARC uses OCI registry (no Helm repo needed)
-      echo "Using official GitHub OCI chart (no Helm repo needed)"
-      
-      # Install official ARC controller using OCI chart
-      echo "Installing official GitHub ARC controller version ${var.github_arc_controller_version}..."
-      NAMESPACE="actions-runner-system"
-      RELEASE_NAME="gha-runner-scale-set-controller"
-      CHART="oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller"
-      ARC_VERSION="${var.github_arc_controller_version}"
-      
-      # Check if already installed
-      if helm list -n "$${NAMESPACE}" 2>/dev/null | grep -q "^$${RELEASE_NAME}\\s"; then
-        echo "  ARC controller already installed, upgrading to version $${ARC_VERSION}..."
-        helm upgrade "$${RELEASE_NAME}" "$${CHART}" \
-          --namespace "$${NAMESPACE}" \
-          --version "$${ARC_VERSION}" \
-          --wait=false
-      else
-        echo "  Installing official ARC controller version $${ARC_VERSION}..."
-        helm install "$${RELEASE_NAME}" "$${CHART}" \
-          --namespace "$${NAMESPACE}" \
-          --create-namespace \
-          --version "$${ARC_VERSION}" \
-          --wait=false
-      fi
-      
-      echo "✓ Official ARC controller installed (version $${ARC_VERSION})"
-      
-      # Wait a moment for CRDs to be created
-      sleep 5
-      
-      # Verify CRDs are installed (these are what Fleet needs)
-      echo ""
-      echo "Verifying ARC CRDs installation (Official Version)..."
-      if kubectl get crd autoscalingrunnersets.actions.github.com &>/dev/null; then
-        echo "✓ Required CRDs installed:"
-        kubectl get crd | grep -E "autoscalingrunnersets|ephemeralrunnersets|ephemeralrunners" || true
-      else
-        echo "⚠ CRDs may still be installing, but controller chart is installed"
-      fi
-      
-      echo ""
-      echo "ARC Controller Pods:"
-      kubectl get pods -n "$${NAMESPACE}" -l app.kubernetes.io/name=gha-runner-scale-set-controller || echo "Pods may still be starting..."
-      
-      echo ""
-      echo "=========================================="
-      echo "Configuring RBAC for ARC Controller"
-      echo "=========================================="
-      
-      # Ensure managed-cicd namespace exists
-      RUNNER_NAMESPACE="managed-cicd"
-      if ! kubectl get namespace "$${RUNNER_NAMESPACE}" &>/dev/null; then
-        echo "Creating namespace: $${RUNNER_NAMESPACE}"
-        kubectl create namespace "$${RUNNER_NAMESPACE}" || true
-      fi
-      
-      # Wait for controller ServiceAccount to be created
-      echo "Waiting for controller ServiceAccount..."
-      CONTROLLER_SA="gha-runner-scale-set-controller-gha-rs-controller"
-      for i in {1..30}; do
-        if kubectl get serviceaccount "$${CONTROLLER_SA}" -n "$${NAMESPACE}" &>/dev/null; then
-          echo "✓ Controller ServiceAccount found"
-          break
-        fi
-        if [ $i -eq 30 ]; then
-          echo "⚠ Warning: Controller ServiceAccount not found, but continuing..."
-        fi
-        sleep 2
-      done
-      
-      # Create Role for managing secrets and RBAC in managed-cicd namespace
-      # The controller needs to:
-      # 1. Read/create secrets (for github-app-secret authentication and listener config)
-      # 2. Create/manage Roles and RoleBindings (for AutoscalingListener pods)
-      echo "Creating Role for secret and RBAC access in $${RUNNER_NAMESPACE} namespace..."
-      kubectl apply -f - <<EOF
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: arc-controller-secret-reader
-  namespace: $${RUNNER_NAMESPACE}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "list", "watch", "create", "update", "patch"]
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["roles", "rolebindings"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-EOF
-      
-      # Create RoleBinding to grant controller ServiceAccount permission to read secrets
-      echo "Creating RoleBinding for controller secret access..."
-      kubectl apply -f - <<EOF
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: arc-controller-secret-reader
-  namespace: $${RUNNER_NAMESPACE}
-subjects:
-- kind: ServiceAccount
-  name: $${CONTROLLER_SA}
-  namespace: $${NAMESPACE}
-roleRef:
-  kind: Role
-  name: arc-controller-secret-reader
-  apiGroup: rbac.authorization.k8s.io
-EOF
-      
-      echo "✓ RBAC configured: Controller can now read secrets in $${RUNNER_NAMESPACE} namespace"
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ Official ARC deployment complete"
-      echo "=========================================="
-      echo ""
-      echo "Note: CRDs are installed immediately. Fleet can now validate"
-      echo "AutoscalingRunnerSet resources (official GitHub version)."
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing GitHub ARC Controller from PRD Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$HOME/.kube/prd-apps.yaml"
-      
-      if helm list -n actions-runner-system 2>/dev/null | grep -qE "(actions-runner-controller|gha-runner-scale-set-controller)"; then
-        echo "Uninstalling ARC controller..."
-        helm uninstall actions-runner-controller -n actions-runner-system 2>/dev/null || true
-        helm uninstall gha-runner-scale-set-controller -n actions-runner-system 2>/dev/null || true
-        
-        echo "Cleaning up RBAC resources..."
-        kubectl delete rolebinding arc-controller-secret-reader -n managed-cicd 2>/dev/null || true
-        kubectl delete role arc-controller-secret-reader -n managed-cicd 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace actions-runner-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ ARC controller removed"
-      else
-        echo "✓ ARC controller already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_prd_apps
-  ]
-
-  triggers = {
-    arc_chart_version = var.github_arc_controller_version
-  }
-}
-
-resource "null_resource" "deploy_arc_poc_apps" {
-  provisioner "local-exec" {
-    command = <<-EOT
-      set -e
-      
-      echo "=========================================="
-      echo "Deploying Official GitHub ARC Controller to POC Apps Cluster"
-      echo "=========================================="
-      
-      # Set kubeconfig to poc-apps cluster
-      export KUBECONFIG="$HOME/.kube/poc-apps.yaml"
-      
-      # Verify cluster access
-      if ! kubectl cluster-info &>/dev/null; then
-        echo "ERROR: Cannot access poc-apps cluster"
-        exit 1
-      fi
-      
-      echo "✓ Cluster access verified"
-      
-      # Check if Helm is available
-      if ! command -v helm &>/dev/null; then
-        echo "ERROR: helm not found"
-        exit 1
-      fi
-      
-      # Official GitHub ARC uses OCI registry (no Helm repo needed)
-      echo "Using official GitHub OCI chart (no Helm repo needed)"
-      
-      # Install official ARC controller using OCI chart
-      echo "Installing official GitHub ARC controller version ${var.github_arc_controller_version}..."
-      NAMESPACE="actions-runner-system"
-      RELEASE_NAME="gha-runner-scale-set-controller"
-      CHART="oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller"
-      ARC_VERSION="${var.github_arc_controller_version}"
-      
-      # Check if already installed
-      if helm list -n "$${NAMESPACE}" 2>/dev/null | grep -q "^$${RELEASE_NAME}\\s"; then
-        echo "  ARC controller already installed, upgrading to version $${ARC_VERSION}..."
-        helm upgrade "$${RELEASE_NAME}" "$${CHART}" \
-          --namespace "$${NAMESPACE}" \
-          --version "$${ARC_VERSION}" \
-          --wait=false
-      else
-        echo "  Installing official ARC controller version $${ARC_VERSION}..."
-        helm install "$${RELEASE_NAME}" "$${CHART}" \
-          --namespace "$${NAMESPACE}" \
-          --create-namespace \
-          --version "$${ARC_VERSION}" \
-          --wait=false
-      fi
-      
-      echo "✓ Official ARC controller installed (version $${ARC_VERSION})"
-      
-      # Wait a moment for CRDs to be created
-      sleep 5
-      
-      # Verify CRDs are installed (these are what Fleet needs)
-      echo ""
-      echo "Verifying ARC CRDs installation (Official Version)..."
-      if kubectl get crd autoscalingrunnersets.actions.github.com &>/dev/null; then
-        echo "✓ Required CRDs installed:"
-        kubectl get crd | grep -E "autoscalingrunnersets|ephemeralrunnersets|ephemeralrunners" || true
-      else
-        echo "⚠ CRDs may still be installing, but controller chart is installed"
-      fi
-      
-      echo ""
-      echo "ARC Controller Pods:"
-      kubectl get pods -n "$${NAMESPACE}" -l app.kubernetes.io/name=gha-runner-scale-set-controller || echo "Pods may still be starting..."
-      
-      echo ""
-      echo "=========================================="
-      echo "Configuring RBAC for ARC Controller"
-      echo "=========================================="
-      
-      # Ensure managed-cicd namespace exists
-      RUNNER_NAMESPACE="managed-cicd"
-      if ! kubectl get namespace "$${RUNNER_NAMESPACE}" &>/dev/null; then
-        echo "Creating namespace: $${RUNNER_NAMESPACE}"
-        kubectl create namespace "$${RUNNER_NAMESPACE}" || true
-      fi
-      
-      # Wait for controller ServiceAccount to be created
-      echo "Waiting for controller ServiceAccount..."
-      CONTROLLER_SA="gha-runner-scale-set-controller-gha-rs-controller"
-      for i in {1..30}; do
-        if kubectl get serviceaccount "$${CONTROLLER_SA}" -n "$${NAMESPACE}" &>/dev/null; then
-          echo "✓ Controller ServiceAccount found"
-          break
-        fi
-        if [ $i -eq 30 ]; then
-          echo "⚠ Warning: Controller ServiceAccount not found, but continuing..."
-        fi
-        sleep 2
-      done
-      
-      # Create Role for managing secrets and RBAC in managed-cicd namespace
-      # The controller needs to:
-      # 1. Read/create secrets (for github-app-secret authentication and listener config)
-      # 2. Create/manage Roles and RoleBindings (for AutoscalingListener pods)
-      echo "Creating Role for secret and RBAC access in $${RUNNER_NAMESPACE} namespace..."
-      kubectl apply -f - <<EOF
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: arc-controller-secret-reader
-  namespace: $${RUNNER_NAMESPACE}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "list", "watch", "create", "update", "patch"]
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["roles", "rolebindings"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-EOF
-      
-      # Create RoleBinding to grant controller ServiceAccount permission to read secrets
-      echo "Creating RoleBinding for controller secret access..."
-      kubectl apply -f - <<EOF
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: arc-controller-secret-reader
-  namespace: $${RUNNER_NAMESPACE}
-subjects:
-- kind: ServiceAccount
-  name: $${CONTROLLER_SA}
-  namespace: $${NAMESPACE}
-roleRef:
-  kind: Role
-  name: arc-controller-secret-reader
-  apiGroup: rbac.authorization.k8s.io
-EOF
-      
-      echo "✓ RBAC configured: Controller can now read secrets in $${RUNNER_NAMESPACE} namespace"
-      
-      echo ""
-      echo "=========================================="
-      echo "✓ Official ARC deployment complete"
-      echo "=========================================="
-      echo ""
-      echo "Note: CRDs are installed immediately. Fleet can now validate"
-      echo "AutoscalingRunnerSet resources (official GitHub version)."
-    EOT
-  }
-
-  provisioner "local-exec" {
-    when       = destroy
-    on_failure = continue
-    command    = <<-EOT
-      echo "=========================================="
-      echo "Removing GitHub ARC Controller from POC Apps Cluster"
-      echo "=========================================="
-      
-      export KUBECONFIG="$HOME/.kube/poc-apps.yaml"
-      
-      if helm list -n actions-runner-system 2>/dev/null | grep -qE "(actions-runner-controller|gha-runner-scale-set-controller)"; then
-        echo "Uninstalling ARC controller..."
-        helm uninstall actions-runner-controller -n actions-runner-system 2>/dev/null || true
-        helm uninstall gha-runner-scale-set-controller -n actions-runner-system 2>/dev/null || true
-        
-        echo "Cleaning up RBAC resources..."
-        kubectl delete rolebinding arc-controller-secret-reader -n managed-cicd 2>/dev/null || true
-        kubectl delete role arc-controller-secret-reader -n managed-cicd 2>/dev/null || true
-        
-        echo "Deleting namespace..."
-        kubectl delete namespace actions-runner-system --timeout=2m 2>/dev/null || true
-        
-        echo "✓ ARC controller removed"
-      else
-        echo "✓ ARC controller already removed"
-      fi
-    EOT
-  }
-
-  depends_on = [
-    null_resource.merge_kubeconfigs,
-    module.rke2_poc_apps
-  ]
-
-  triggers = {
-    arc_chart_version = var.github_arc_controller_version
-  }
-}
diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example
index f4646ad..6244998 100644
--- a/terraform/terraform.tfvars.example
+++ b/terraform/terraform.tfvars.example
@@ -356,27 +356,15 @@ kube_vip_ip_pools = {
 }
 
 # ============================================================================
-# OPENSEARCH OPERATOR CONFIGURATION
+# CLOUDNATIVEPG OPERATOR CONFIGURATION
 # ============================================================================
 
-# OpenSearch Kubernetes Operator Helm chart version (default: 2.8.0)
-# Check latest version: https://github.com/opensearch-project/opensearch-k8s-operator/releases
-opensearch_operator_version = "2.8.0"
-
-# MongoDB Community Operator Helm chart version (default: 0.13.0)
-# Check latest version: https://github.com/mongodb/mongodb-kubernetes-operator/releases
-mongodb_operator_version = "0.13.0"
-
 # CloudNativePG Operator version (default: 1.30.1)
 # Installed via manifest (server-side apply), not Helm. Bumping it re-applies the
 # manifest; existing PostgreSQL clusters roll their instance managers (primary last).
 # Read the release notes first: https://cloudnative-pg.io/documentation/current/release_notes/
 cloudnativepg_operator_version = "1.30.1"
 
-# GitHub Actions Runner Controller (ARC) Helm chart version (default: 0.13.1)
-# Check latest version: https://github.com/actions/actions-runner-controller/releases
-github_arc_controller_version = "0.13.1"
-
 # ============================================================================
 # PALWORLD OPERATOR CONFIGURATION
 # ============================================================================
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 0794269..71b0618 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -389,30 +389,12 @@ variable "envoy_gateway_version" {
   default     = "v1.9.2"
 }
 
-variable "opensearch_operator_version" {
-  description = "OpenSearch Kubernetes Operator Helm chart version"
-  type        = string
-  default     = "2.8.0"
-}
-
-variable "mongodb_operator_version" {
-  description = "MongoDB Community Operator Helm chart version"
-  type        = string
-  default     = "0.13.0"
-}
-
 variable "cloudnativepg_operator_version" {
   description = "CloudNativePG Operator version (installed via manifest)"
   type        = string
   default     = "1.30.1"
 }
 
-variable "github_arc_controller_version" {
-  description = "GitHub Actions Runner Controller (ARC) Helm chart version"
-  type        = string
-  default     = "0.13.1"
-}
-
 # ============================================================================
 # PALWORLD OPERATOR CONFIGURATION
 # ============================================================================